Timing attack on API key via String.equals()

[consigcody94]

Found via code audit. ApiKeyAuthFilter.java:76. Short-circuits on first diff byte. Use MessageDigest.isEqual().

[fkapsahili]

Had a look, this isn't wrong. The comparison moved to ApiKeyAuthenticator (line 68) after the RBAC refactor, and it only affects the legacy DOKIMOS_API_KEY path now, since scoped keys are matched by hash. Severity is low for a server-side compare behind HTTP/TLS, but it's cheap to harden with MessageDigest.isEqual, so keeping it open. Thanks for the report.