Use Constant-Time Equals

This commit updates the filter to use constant-time
equals for sensitive material

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>

core/src/main/java/org/springframework/security/core/token/KeyBasedPersistenceTokenService.java

@@ -132,7 +132,7 @@ public class KeyBasedPersistenceTokenService implements TokenService, Initializi
 		// Verification
 		String content = creationTime + ":" + pseudoRandomNumber + ":" + extendedInfo.toString();
 		String expectedSha512Hex = Sha512DigestUtils.shaHex(content + ":" + serverSecret);
-		Assert.isTrue(expectedSha512Hex.equals(sha1Hex), "Key verification failure");
+		Assert.isTrue(Utf8.isEqual(expectedSha512Hex, sha1Hex), "Key verification failure");
 		return new DefaultToken(key, creationTime, extendedInfo.toString());
 	}