hash_equals: Don't leak length difference.

`hash_equals` leaks difference in length of compared strings (this is a documented behavior).
This implementation ported from Symfony don't.

The discussion started in a try to use `hash_equals` in Symfony: https://github.com/symfony/symfony/pull/11797