aead: support variable-length nonces

[oberien]

Currently, the AEAD-trait only supports fixed-length nonces. However, there are some AEAD algorithms, which allow variable length nonces to be used. I think this is important not only for interoperability with other implementations, but also to not restrict the input of AEAD algorithms arbitrarily. Some cases have already been discussed in RustCrypto/AEADs#62 and https://github.com/RustCrypto/traits/pull/40/files/a5db8f2d8e07593883e7e6aba27eb4e9d54b9460#r307931303.

I could imagine, for type-safety, adding a new trait like AeadVarlenNonce, which is only implemented for algorithms supporting it, or adding a method to the existing Aead trait, which takes a &[u8] as nonce, but may return an Err (or None or panic) if the algorithm doesn't support varlen nonces.

/cc @tarcieri

[tarcieri]

Variable-length nonces would be nice for AES-SIV. Miscreant supported them.

[tarcieri]

Per RustCrypto/AEADs#126 it seems like the best solution to this is to make implementations of algorithms which support multiple different nonce sizes generic over Aead::NonceSize, which requires no changes to the trait.