Two small, but important changes

* separated definition / implementation -- useful for actual usage
* use of xor instead of comparision in timingsafe_bcmp() -- see http://rdist.root.org/2010/01/07/timing-independent-array-comparison/ and https://lobste.rs/s/snlsqj/safe_explicit_bzero_timingsafe_bcmp_for_linux