fix: use time-constant comparison for security tokens (#12189) (#12195)

fix: use time-constant comparison for security tokens (#12189) (#12195)

This is the same as https://github.com/vaadin/framework/pull/12188,
but also applied for the upload security key
and the push id since both of those are also used to protect against
cross-site attacks. In addition, documentation for the push id is
clarified to point out its role.

Cherry-picked from: https://github.com/vaadin/flow/pull/9896

Authored-by: Tatu Lund <tatu@vaadin.com>