[fix][broker] Use MessageDigest.isEqual when comparing digests (apach…

…e#21061)

(cherry picked from commit c05954e)

pulsar-broker-auth-sasl/src/main/java/org/apache/pulsar/broker/authentication/SaslRoleTokenSigner.java

@@ -76,7 +76,7 @@ public String verifyAndExtract(String signedStr) throws AuthenticationException
         String originalSignature = signedStr.substring(index + SIGNATURE.length());
         String rawValue = signedStr.substring(0, index);
         String currentSignature = computeSignature(rawValue);
-        if (!originalSignature.equals(currentSignature)) {
+        if (!MessageDigest.isEqual(originalSignature.getBytes(), currentSignature.getBytes())){
             throw new AuthenticationException("Invalid signature");
         }
         return rawValue;