Replace custom secureCompare with crypto/subtle.ConstantTimeCompare

Remove the hand-rolled secureCompare function and use the standard
library's crypto/subtle.ConstantTimeCompare for CSRF token validation.
Remove the corresponding unit test for the deleted function; CSRF token
comparison is still covered by the integration tests.

internal/middleware/csrf_test.go

@@ -173,12 +173,3 @@ func TestGenerateCSRFToken(t *testing.T) {
 	require.NoError(t, err)
 	assert.NotEqual(t, token, token2, "each generated token should be unique")
 }
-
-func TestSecureCompare(t *testing.T) {
-	t.Parallel()
-	assert.True(t, secureCompare("abc", "abc"))
-	assert.False(t, secureCompare("abc", "abd"))
-	assert.False(t, secureCompare("abc", "ab"))
-	assert.False(t, secureCompare("", "a"))
-	assert.True(t, secureCompare("", ""))
-}