ConstantTimeCompare swallows an unreachable bounds error

[SeanTAllen]

ssl/crypto/constant_time_compare.pony:

while i < xs.size() do
  try
    v = v or (xs(i)? xor ys(i)?)
  else
    return false
  end
  i = i + 1
end

xs(i)? cannot raise: i < xs.size() bounds it. ys(i)? cannot raise either: the enclosing else branch has established xs.size() == ys.size(), so i < xs.size() bounds it too. The try's else return false is dead code, and it absorbs an impossible error rather than crashing with a location if the impossible case ever fired.

This is the same shape as #95, in a package that issue's fix did not reach. It differs in one way: at #95's two sites the try also held a reachable error, so the fix removed the guard and let the real ? carry meaning. Here the whole try is unreachable, so that route does not apply. A panic in the else would fit, but ssl/crypto has no panic primitive.