String comparison timing attacks in Go