Webhook token disclosure via timing-unsafe hash comparison

Timing side channel in Jenkins Zanata Plugin 0.6 and earlier allows remote attackers to obtain a valid webhook token. The webhook token verifier compares provided and expected token hashes with a non-constant-time equality operation, exposing hash-comparison timing differences. The endpoint must be remotely measurable across enough repeated requests; the documented consequence is disclosure of a usable token, not direct code execution or service interruption.