Remove a timing channel in Password matching

Hi, 

I found a timing channel in Password.java:
https://github.com/eclipse/jetty.project/blob/jetty-9.4.x/jetty-util/src/main/java/org/eclipse/jetty/util/security/Password.java#L105

By using Arrays.equals, it actually violates the "constant-time-implementation" discipline.

For more information about timing attack:
https://codahale.com/a-lesson-in-timing-attacks/