Use cryptography.hazmat.primitives.constant_time.bytes_eq instead of allmydata.util.hashutil.timing_safe_compare.

[tomprince]

The later looks slightly more complex, but should have the same observable behaviour. The main motivation is removing a dependency on allmydata.

The one use is in magic_folder.web._is_authorized.

[meejah]

+1 sounds fine. Low-priority.

(Honestly, I think I'd rather not use the secret directly but instead use it as the key for an HMAC or similar so that we don't leak the secret itself in headers .. but also I Am Not A Cryptographer)