[services-lib] Use constant-time-eq for token verification

Summary:
verify_access_token in Identity Service does this so probably we should do it here too.

Depends on D9241

Test Plan: I did some simple comparisons and it seems to work fine.

Reviewers: varun, michal, jon

Reviewed By: varun, michal

Subscribers: ashoat, tomek

Differential Revision: https://phab.comm.dev/D9242