Disable security/detect-possible-timing-attacks in client

[edg2s]

This is the source of lots of false positives with variables named hash. If we are doing actual password comparison in the client, then something has gone badly wrong, so I don't think we need this rule, at the very least in the client.

[edg2s]

cc @sbassett29