chore: use string-timing-safe-equal package

This change should have no user impact.

I just published [`string-timing-safe-equal`][0], a package that
replaces our `timingSafeEqual` utility.

I think this is a useful change on its own but will make an upcoming
server change smaller.

[0]: https://www.npmjs.com/package/string-timing-safe-equal

package.json

@@ -192,6 +192,7 @@
     "sodium-universal": "^4.0.0",
     "start-stop-state-machine": "^1.2.0",
     "streamx": "^2.19.0",
+    "string-timing-safe-equal": "^0.1.0",
     "styled-map-package": "^2.0.0",
     "sub-encoder": "^2.1.1",
     "throttle-debounce": "^5.0.0",

src/invite-api.js

@@ -3,7 +3,7 @@ import { pEvent } from 'p-event'
 import { InviteResponse_Decision } from './generated/rpc.js'
 import { assert, keyToId, noop } from './utils.js'
 import HashMap from './lib/hashmap.js'
-import timingSafeEqual from './lib/timing-safe-equal.js'
+import timingSafeEqual from 'string-timing-safe-equal'
 import { Logger } from './logger.js'
 /** @import { MapBuffers } from './types.js' */
 /**

src/member-api.js

@@ -11,7 +11,7 @@ import {
 } from './utils.js'
 import { keyBy } from './lib/key-by.js'
 import { abortSignalAny } from './lib/ponyfills.js'
-import timingSafeEqual from './lib/timing-safe-equal.js'
+import timingSafeEqual from 'string-timing-safe-equal'
 import { ROLES, isRoleIdForNewInvite } from './roles.js'
 /**
  * @import {