[Draft] Implement a fast-key-erasure ChaCha variant

[dhardy]

Motivated by rust-random/rand#1826 (comment), I wanted to see if we could support a fast-key-erasure generator. Yes, I believe we can, and without much code.

Performance penalty: 12-13% for 1kiB blocks, 20-25% for single u32 values.

Details

There are two parts to this:

1. We overwrite the key using the first 8 (of 64) values from the results buffer after each generation.
2. We overwrite each value consumed from the buffer with zero.

I believe this is all that's required for forward security.

Reseeding?

As noted here, forward security (backtracking resistance) arguably has more value than "backward security" (reseeding) since if an attacker has compromised the system state, there is reason to believe they may be able to do so again. On the other hand, periodic reseeding may be useful for other reasons, e.g. if a process is forked without explicit reseeding (i.e. a bug).

Anyway, there is no reason we can't layer one on top of the other.