reverseproxy: compare sticky-session cookie hash in constant time (#7853)