app: Use constant-time comparison for bearer token validation (#65204)

Replace direct string comparison with `checkSubjectToken`, which
uses `subtle.ConstantTimeCompare`. The other code path in
`auth.go` already used constant-time comparison via the same
function. Preserve the audit event on mismatch.

lib/web/app/handler.go

@@ -468,8 +468,7 @@ func (h *Handler) getAppSessionFromCookie(r *http.Request) (types.WebSession, er
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	if ws.GetBearerToken() != subjectValue {
-		err := trace.AccessDenied("subject session token does not match")
+	if err := checkSubjectToken(subjectValue, ws); err != nil {
 		h.c.AuthClient.EmitAuditEvent(h.closeContext, &apievents.AuthAttempt{
 			Metadata: apievents.Metadata{
 				Type: events.AuthAttemptEvent,