fix: use timing-safe comparison for social account token validation

[steinkel]

• Replace === with hash_equals() in SocialAccountBehavior::validateAccount() to prevent timing attacks on the token comparison
• Add tests for partial and empty token rejection
• Fix UsersFixture missing tableAlias causing _schemaFromReflection to resolve a generic Table instead of UsersTable, which skips the json type override for additional_data
• Correct schema.php discrepancies against migrations: users.active default, users.secret length, users.secret_verified default, social_accounts.avatar type and social_accounts.link type

[Copilot]

Pull request overview

This PR hardens social account token validation against timing attacks by switching to a timing-safe comparison, and updates the test suite/fixture schema to better reflect current expectations.

Changes:

• Use hash_equals() for token comparison in SocialAccountBehavior::validateAccount().
• Add behavior tests to ensure partial and empty tokens are rejected.
• Update test fixtures/schema metadata (including UsersFixture aliasing) to correct schema mismatches and improve JSON handling.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
src/Model/Behavior/SocialAccountBehavior.php	Switch token equality check to hash_equals() for timing-safe comparison.
tests/TestCase/Model/Behavior/SocialAccountBehaviorTest.php	Add regression tests for partial/empty token rejection.
tests/Fixture/UsersFixture.php	Add explicit table alias to ensure the correct Table class/schema overrides are used.
tests/schema.php	Adjust test schema metadata for several columns/types/defaults to better match expectations.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.