use |= rather than += for bufeq_secure

I know it's an extremely remote possibility, but I chose to use `|=` rather than `+=` when writing [`buffer-equal-constant-time`](https://github.com/goinstant/buffer-equal-constant-time/blob/master/index.js#L8).  It has the added benefit of keeping within a `uint32_t` and can therefore be optimized into integer rather than floating point machine code instructions.

If you know a good reason to not use `|=`, please let me know!