Use constant-time comparison for alert webhook tokens

What does this MR do and why?

The HTTP alert integration and PagerDuty webhook endpoints compared the caller's token with ==. That check isn't constant-time, so it can leak timing information. They now use ActiveSupport::SecurityUtils.secure_compare, like the Prometheus alert endpoint already does.

Missing tokens, or tokens that aren't strings (for example a JSON number), are now rejected as unauthorized instead of raising a 500.

Rate limiting these endpoints is out of scope and is tracked in Rate limit alert and PagerDuty webhook ingest e... (#632636).

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/632507+

https://gitlab.com/gitlab-org/gitlab/-/work_items/632505+

Screenshots or screen recordings

No UI changes.

How to set up and validate locally

1. In a project, go to Settings > Monitor > Alerts. Add an HTTP endpoint integration and copy its URL and authorization key. On the PagerDuty integration tab, enable it and copy the webhook URL.

2. Send an alert with the correct token. Expect HTTP 200.

   curl -k -i -X POST \
     -H "Authorization: Bearer <token>" \
     -H "Content-Type: application/json" \
     -d '{"title": "Test alert"}' \
     "https://gdk.test:3443/<namespace>/<project>/-/alerts/notify/<integration-name>/<integration-id>.json"

3. Repeat the same request with a wrong token in the Authorization header. Expect HTTP 401.

4. Send a PagerDuty request with the correct token from the webhook URL. Expect HTTP 202.

   curl -k -i -X POST \
     -H "Content-Type: application/json" \
     -d '{"messages": []}' \
     "https://gdk.test:3443/<namespace>/<project>/-/incidents/integrations/pagerduty?token=<token>"

5. Send a PagerDuty request with ?token=wrong. Expect HTTP 401. Then send one with the token only in the JSON body as a number. Expect HTTP 401, not a 500.

   curl -k -i -X POST \
     -H "Content-Type: application/json" \
     -d '{"token": 123}' \
     "https://gdk.test:3443/<namespace>/<project>/-/incidents/integrations/pagerduty"

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Closes https://gitlab.com/gitlab-org/gitlab/-/work_items/632507 Closes https://gitlab.com/gitlab-org/gitlab/-/work_items/632505