Move to platform-native string comparison

We currently hand-roll the timing-safe equals for compatibility reasons across runtimes. We should check if we should use a ponyfill instead.

We probably cannot use https://github.com/w3c/webcrypto/issues/270 yet because it is not part of the standard, but we can hopefully do this in the future.

Start by locating the current hand-rolled timing-safe equals implementation and checking the runtimes it supports. Review the linked W3C WebCrypto issue before assessing whether a ponyfill is viable. Done means the comparison approach is selected, compatibility behavior is preserved across supported runtimes, and relevant coverage is updated.

Written by the indexing model from the issue text.