4469 compare string without shortcut

If `compareString()` is to be a public method (I'm not 100% sure about that) then it shouldn't leak information about the length of `$expected`. In this version it's timing depends only on the length of the `$actual` input. Param docs change to encourage users to put the external input in `$actual`.