fix: guard against mismatched HMAC length in NexoCrypto.validateHmac (#1703)

crypto.timingSafeEqual throws a raw TypeError when the two buffers differ
in length, so a tampered message with a truncated or malformed HMAC raised
an unhandled TypeError instead of the expected NexoCryptoException. Add a
length check before timingSafeEqual so a length mismatch is treated as an
invalid HMAC. Includes a regression test for a different-length HMAC.