Verify a webhook signature in constant time

$expected = hash_hmac('sha256', file_get_contents('php://input'), $secret);

if (! hash_equals($expected, $_SERVER['HTTP_X_GITLAB_TOKEN'] ?? '')) {
    http_response_code(403);
    exit;
}