Use constant-time comparison when validating the server certificate fingerprint

In the MitM-proof authentication path, the driver derives the expected validation hash (SHA-256 over the user's hashed password, the scramble, and the captured certificate fingerprint) and compares it against the value supplied by the server. The comparison used String.equals: return hashHex.equals(serverValidationHex);

String.equals is not constant-time: it returns early on a length mismatch and on the first differing character, so the execution time depends on the length of the matching prefix.

Because the server-supplied value is attacker-influenceable, this is a timing side-channel — an attacker able to measure the client's accept/reject timing could, in principle, recover the expected hash byte by byte and forge a valid server proof.

correction :
Compare with a constant-time routine that does not short-circuit:

return MessageDigest.isEqual(
hashHex.getBytes(StandardCharsets.US_ASCII),
serverValidationHex.getBytes(StandardCharsets.US_ASCII));

thanks jmestwa-coder for report and PR : https://github.com/mariadb-corporation/mariadb-connector-j/pull/224