Use constant time string comparison in FormKey validator

CSRF tokens should be considered sensitive strings. While the
risk of a malicious actor attempting gleam the form key via a
timing attack is very low, we should still follow best practices
in verifying this token.

Author: p0pr0ck5

lib/internal/Magento/Framework/Data/Form/FormKey/Validator.php

@@ -5,6 +5,8 @@
  */
 namespace Magento\Framework\Data\Form\FormKey;
 
+use Magento\Framework\Encryption\Helper\Security;
+
 /**
  * @api
  */
@@ -32,9 +34,11 @@ public function __construct(\Magento\Framework\Data\Form\FormKey $formKey)
     public function validate(\Magento\Framework\App\RequestInterface $request)
     {
         $formKey = $request->getParam('form_key', null);
-        if (!$formKey || $formKey !== $this->_formKey->getFormKey()) {
+
+        if (!$formKey) {
             return false;
         }
-        return true;
+
+        return Security::compareStrings($formKey, $this->_formKey->getFormKey());
     }
 }