fix: use time-constant comparison for security tokens (#12192)

fix: use time-constant comparison for security tokens (#12192)

This is the same as #12190, but also applied for the upload security key
and the push id since both of those are also used to protect against
cross-site attacks. In addition, documentation for the push id is
clarified to point out its role.

Backporting of #12189