Use hash_equals for comparing username in allow/deny rules

The comparison should happen in constant time to avoid possible leak of
usernames in rules.

Signed-off-by: Michal Čihař <michal@cihar.com>

libraries/ip_allow_deny.lib.php

@@ -306,7 +306,7 @@ function PMA_allowDeny($type)
 
         // check for username
         if (($rule_data[1] != '%') //wildcarded first
-            && ($rule_data[1] != $username)
+            && (! hash_equals($rule_data[1], $username))
         ) {
             continue;
         }