use constant-time comparison for auth token validation

[extrasmall0]

The auth middleware in auth.rs uses == for comparing the X-Secret-Key header against the stored secret. Rust's default string comparison short-circuits on the first differing byte, which leaks timing information that could let an attacker recover the key incrementally.

This swaps the comparison for subtle::ConstantTimeEq::ct_eq, which always compares every byte regardless of where they differ. subtle is already in the dependency tree (pulled in transitively), so this just adds it as a direct dep for goose-server.

The explicit key.len() == state.len() guard before ct_eq is technically redundant (ct_eq on unequal-length slices returns 0), but makes the intent clearer and avoids doing the full comparison when lengths obviously differ.

Closes #7710

[jh-block]

Doesn't the explicit length guard let an attacker know whether their key is the right length or not based on the timing? I don't think it makes the intent clearer and doing the full computation every time is rather the point of constant time comparison. Happy to merge if that is removed.

[extrasmall0]

Good point — the length check does leak that info through timing. Removed it in 99e1d11, ct_eq handles different lengths fine on its own.

[extrasmall0]

Thanks for the quick review and merge @jh-block!