crypto: use timing-safe comparison in Web Cryptography HMAC

Use `CRYPTO_memcmp` instead of `memcmp` in `HMAC`
Web Cryptography algorithm implementations.

Ref: https://hackerone.com/reports/3533945
Backport-PR-URL: nodejs-private/node-private#830
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: nodejs-private/node-private#822
CVE-ID: CVE-2026-21713

Author: panva

src/crypto/crypto_hmac.cc

@@ -264,7 +264,8 @@ MaybeLocal<Value> HmacTraits::EncodeOutput(Environment* env,
       return Boolean::New(
           env->isolate(),
           out->size() > 0 && out->size() == params.signature.size() &&
-              memcmp(out->data(), params.signature.data(), out->size()) == 0);
+              CRYPTO_memcmp(
+                  out->data(), params.signature.data(), out->size()) == 0);
   }
   UNREACHABLE();
 }