bark-rest: compare auth tokens in constant time

Split this off from !2361 (merged). I wanted to prompt a discussion about it without holding up the other MR. This came out of an investigation by Kimi and seemed like an easy win. The theory was that a malicious piece of software could try to figure out the auth token locally by testing different characters and seeing how long it takes for the request to be declined as unauthenticated. The suggestion of using subtle was due to it already being an upstream dependency in the workspace.

Happy for this to be closed if undesirable.