Use PHP hash_equals() to compare the token

This avoids a possible timing attack.
hash_equals() was introduced in PHP 5.6.

src/Totp.php

@@ -159,7 +159,7 @@ public static function verify(
         $stepEnd   = $currentStep + (int)$acceptStepFuture + 1;
         for ($testTimeStep = $stepBegin; $testTimeStep < $stepEnd; ++$testTimeStep) {
             $testValue = self::calcMain($keyBinary, $testTimeStep, $digits, $hash);
-            if ($testValue === $value) {
+            if (hash_equals($testValue, $value)) {
                 return true;
             }
         }