Add stricter checking on mac key lengths.

Negative lengths are always invalid. The key length should also
be zero for hash algorithms that do not accept a key.

admbugs: 949
Reported by: Yuval Kanarenstein <yuvalk@ssd-disclosure.com>
Reviewed by: cem
MFC after: 1 week
Sponsored by: Chelsio Communications
Differential Revision: https://reviews.freebsd.org/D23094