crypto: Support Chacha20-Poly1305 with a nonce size of 8 bytes.

[jhb]

Summary

This is useful for WireGuard which uses a nonce of 8 bytes rather
than the 12 bytes used for IPsec and TLS.

Note that this also fixes a (should be) harmless bug in ossl(4) where
the counter was incorrectly treated as a 64-bit counter instead of a
32-bit counter in terms of wrapping when using a 12 byte nonce.
However, this required a single message (TLS record) longer than 64 *
(2^32 - 1) bytes (about 256 GB) to trigger.

Sponsored by: The FreeBSD Foundation

[jhb]

Both ossl0 and cryptosoft0 pass cryptocheck tests with both nonce sizes. In addition, I have used the 8 byte nonce variant in a patch to the upstream Wireguard FreeBSD driver which passed its own tests as well as an interoperability test with the stock driver on another VM using WireGuard's own Chacha20-Poly1305 implementation.

Once this is merged this will need a __FreeBSD_version followup bump so WireGuard (and other potential consumers) can detect when the 8 byte nonce is supported.

[bjk]

Note that this also fixes a (should be) harmless bug in ossl(4) where
the counter was incorrectly treated as a 64-bit counter instead of a
32-bit counter in terms of wrapping when using a 12 byte nonce.
However, this required a single message (TLS record) longer than 64 *
(2^32 - 1) bytes (about 256 GB) to trigger.

TLS itself doesn't allow records larger than (roughly) 2^14 bytes, so
this does seem pretty harmless