Make SSL_SESSION_cmp use CRYPTO_memcmp

There could be potential issues with leaking session ids between
clients, using a timing attack. This patch doesn't guarantee constant
time for SSL_SESSION_cmp, but at least makes it constant time if the
ssl_version and session_id_length are equal, which would make certain
types of attacks more difficult.

For example, if one was attempting to determine the number of active SSL
sessions on a server, this would largely thwart such an attacker.

To be clear: I do not believe this is a significant security issue, but
rather a place where we might be able to more closely match a
developer's expectations of the function.

For reference, see:
- http://seclists.org/fulldisclosure/2014/Apr/117
- https://news.ycombinator.com/item?id=7570043