v8.6.0

• Minor security fix: Compare codes with constant-time hash_equals, #318, thanks to @ThePHPF for sharing
• Minor security fix: Fix pre-poisoning of code-reuse cache, #317, thanks to @ThePHPF for sharing
• Honor post-success listeners that may block authentication, #213, #316, thanks to @giosh94mhz

A minor behavioral change has been introduced: Two-factor providers have been flagged "completed" on the TwoFactorToken immediately after the code was validated. Now, the provider is only flagged, once all post-success listeners have executed.