Fix potential timing attack against TempURL.

Swift's TempURL middleware compares a user-submitted string (HMAC
digest) against a list of valid strings to determine whether or not to
allow access to an object. The string comparison used Python's builtin
string comparison, which short-circuits evaluation on the first
differing character, which may let an attacker perform timing analysis.

This commit changes the string comparison to be constant-time.