Bundled config for functions that are not timing-safe

New bundled configuration file disallowed-non-timing-safe-calls.neon for code that works with keys, tokens, and other secrets: it disallows hex2bin(), bin2hex(), base64_decode(), and base64_encode(), because their runtime depends on the processed bytes and can leak information about them, and recommends the sodium_* functions instead, or ParagonIE\ConstantTime\* when ext-sodium is not available (#433, #434)

includes:
    - vendor/spaze/phpstan-disallowed-calls/disallowed-non-timing-safe-calls.neon

Note: comparing secrets, digests, hashes is the other half - use hash_equals(), not ===, which is an operator, so no rule here can catch it.