[Backport] Use constant time string comparison in FormKey validator

[gelanivishal]

Original Pull Request

#13509

Description

CSRF tokens should be considered sensitive strings. While the risk of a malicious actor attempting gleam the form key via a timing attack is very low, we should still follow best practices in verifying this token.

Contribution checklist

• Pull request has a meaningful description of its purpose
• All commits are accompanied by meaningful commit messages
• All new or changed code is covered with unit/integration tests (if applicable)
• All automated tests passed successfully (all builds on Travis CI are green)

[VladimirZaets]

Hi @gelanivishal. Thanks for the contribution. We can't make backport of @api annotation to Magento 2.1 version because we can't have API annotation with intervals. After API annotation was declared all next versions should have the declared annotation, but in the current case, Magento 2.1 version will contain the annotation but Magento 2.2.0 will not.

[gelanivishal]

@VladimirZaets I have removed API annotation and let me know anything you want to change.

Thank you.

[gelanivishal]

@VladimirZaets Have you checked requested changes?

[magento-engcom-team]

Hi @sidolov, thank you for the review.
ENGCOM-2656 has been created to process this Pull Request

[magento-engcom-team]

Hi @gelanivishal. Thank you for your contribution.
We will aim to release these changes as part of 2.1.15.
Please check the release notes for final confirmation.