Use php 5.6's upcoming hash_equals() function if available

PHP 5.6 will ship with a new function called `hash_equals()` for timing attack safe string comparison. This pull request uses it if available and otherwise falls back to the current behavior.

I know it does not belong to `Encryption` because it's about hashing, not about encryption. But we already have all the other methods there so I stuck to that pattern.

More on `hash_equals()` and PHP 5.6: http://www.php.net/manual/en/migration56.new-features.php

PS: Just to make it clear. I still think https://github.com/contao/core/pull/5853 is the better way to go.