Specifically note constant-time comparisons and auth flow

[david-a-wheeler]

Extend the AI guidance to specifically discuss constant-time comparisons. It's common to fail to do this, so
give specific instructions to counter this tendency.

[david-a-wheeler]

@balteravishay - thoughts?

[balteravishay]

looks great, thanks @david-a-wheeler !

[Copilot]

Pull Request Overview

This PR enhances the security guidance for AI code assistants by specifically emphasizing constant-time comparisons as a critical security practice. The change addresses a common security vulnerability where timing attacks can be used to extract sensitive information through side-channel analysis.

• Adds explicit guidance on using constant-time comparisons for sensitive data operations
• Expands the authentication and authorization section to include timing attack prevention
• Updates the sample instructions to include specific examples of when constant-time comparisons are necessary

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}