Use mb_strlen instead of strlen.

This avoids potential bombs related to `mbstring.func_overload`.
The 8bit encoding does byte counting (which is what we want).

Refs #6139

src/Utility/Security.php

@@ -248,8 +248,8 @@ class Security
         if (function_exists('hash_equals')) {
             return hash_equals($hmac, $compare);
         }
-        $hashLength = strlen($hmac);
-        $compareLength = strlen($compare);
+        $hashLength = mb_strlen($hmac, '8bit');
+        $compareLength = mb_strlen($compare, '8bit');
         if ($hashLength !== $compareLength) {
             return false;
         }