Understanding why crypto.timingSafeEqual is required for comparing secrets and its strict usage constraints.
When comparing a user-supplied HMAC signature against a computed one in a production webhook handler, why is `crypto.timingSafeEqual(a, b)` preferred over `a === b`, and what constraint must you satisfy before calling it?