fix: use SafeCryptoMemEquals for AES-EAX tag verification

[mohammadmseet-hue]

Summary

• Replace hand-rolled EqualBlocks XOR+OR comparison with SafeCryptoMemEquals (wrapping CRYPTO_memcmp) for AEAD authentication tag verification in AES-EAX decrypt
• Remove now-unused EqualBlocks method from AesEaxBoringSsl
• AES-EAX was the only AEAD primitive in Tink not using SafeCryptoMemEquals for tag comparison

Motivation

All other AEAD and MAC implementations in Tink use SafeCryptoMemEquals for authentication tag verification:

Primitive	File	Comparison
AES-SIV	aes_siv_boringssl.cc:294	SafeCryptoMemEquals
HMAC	hmac_boringssl.cc:125	SafeCryptoMemEquals
AES-CMAC	aes_cmac_boringssl.cc:173	SafeCryptoMemEquals
Streaming MAC	streaming_mac_impl.cc:189	SafeCryptoMemEquals
Chunked MAC	chunked_mac_impl.cc:87	SafeCryptoMemEquals
AES-EAX	aes_eax_boringssl.cc:304	EqualBlocks → SafeCryptoMemEquals

The hand-rolled XOR+OR pattern in EqualBlocks is not guaranteed to be constant-time by the C++ standard. While current GCC on x86-64 generates constant-time SSE code, this is not guaranteed across other compilers (MSVC, Clang), architectures (ARM, RISC-V), or with LTO/PGO optimizations. CRYPTO_memcmp uses explicit barriers to prevent compiler optimizations.

Test plan

• Existing AesEaxBoringSslTest tests pass (no behavioral change — both functions return the same boolean result for equal/unequal blocks)
• Verified SafeCryptoMemEquals wraps CRYPTO_memcmp which is the standard constant-time comparison primitive

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.