fix(utils): use hmac.compare_digest for secure WebApp signature validation (#1710)

CHANGES/1709.bugfix.rst

@@ -0,0 +1 @@
+Use `hmac.compare_digest` for validating WebApp data to prevent timing attacks.

aiogram/utils/web_app.py

@@ -134,7 +134,7 @@ def check_webapp_signature(token: str, init_data: str) -> bool:
     calculated_hash = hmac.new(
         key=secret_key.digest(), msg=data_check_string.encode(), digestmod=hashlib.sha256
     ).hexdigest()
-    return calculated_hash == hash_
+    return hmac.compare_digest(calculated_hash, hash_)
 
 
 def parse_webapp_init_data(