CustomerUser: reset token now uses constant-time comparison

Author: vitek-rostislav

src/Model/Customer/User/CustomerUser.php

@@ -456,7 +456,7 @@ public function setResetPasswordHash($resetPasswordHash): void
     #[Override]
     public function isResetPasswordHashValid(?string $hash): bool
     {
-        if ($hash === null || $this->resetPasswordHash !== $hash) {
+        if ($hash === null || $this->resetPasswordHash === null || !hash_equals($this->resetPasswordHash, $hash)) {
             return false;
         }