Secret-length disclosure via early length mismatch return

Observable timing discrepancy in String::Compare::ConstantTime through 0.321 allows remote attackers to infer secret-string length via timing. The equals() routine in ConstantTime.xs compares contents only when lengths match and otherwise returns false immediately, making response time reveal whether a candidate length matches the secret. Exposure requires a consuming service to compare attacker-controlled values with a secret and permit repeated measurements; the disclosed result is the secret length, not its contents.