security(tokens): adds HMAC API and improves token-based security

Uses HMAC and constant-time string comparison for tokens in actions,
friend invites, password resets, and email validation.

Replaces #7245
Can you specifically mention elgg_strlen in the comment?