stop sending the alarm password back on a failed admin check

stop sending the alarm password back on a failed admin check

When the userauth command of the control channel got a wrong hash, the
reply carried the hash received and the string it should have been made
from: G_alarm_passwd, the ip and the session of the admin, in clear, to
whoever had reached the channel. G_alarm_passwd is also the password of
admin.php and the key of the mail verification hashes.

The reply is now a bare "authentication failed". The failure goes to the
daemon log instead, with the name and the ip of the admin and without the
session, which is a credential too. The hashes are compared with
hash_equals rather than !=, which stops at the first differing byte.

Checked by calling direct_command() on a Sac_a_push built without its
constructor and a fake app: the right hash still answers 200, a wrong one
404 with nothing of the secret in the reply, where the previous code
returned it whole.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>