GHSA-q8hg-pf8v-cxrv Symfony Http-Kernel has non-constant time comparison in UriSigner

• Packagist symfony/http-kernel: >= 2.2.0, < 2.8.52 → fixed in 2.8.52 • Packagist symfony/http-kernel: >= 3.0.0, < 3.4.35 → fixed in 3.4.35 • Packagist symfony/http-kernel: >= 4.0.0, < 4.2.12 → fixed in 4.2.12 • Packagist symfony/http-kernel: >= 4.3.0, < 4.3.8 → fixed in 4.3.8 • Packagist symfony/symfony: >= 2.2.0, < 2.8.52 → fixed in 2.8.52 • Packagist symfony/symfony: >= 3.0.0, < 3.4.35 → fixed in 3.4.35 • Packagist symfony/symfony: >= 4.0.0, < 4.2.12 → fixed in 4.2.12 • Packagist symfony/symfony: >= 4.3.0, < 4.3.8 → fixed in 4.3.8

When checking the signature of an URI (an ESI fragment URL for instance), the URISigner did not used a constant time string comparison function, resulting in a potential remote timing attack vulnerability.