Add stricter checking on mac key lengths.
Negative lengths are always invalid. The key length should also
be zero for hash algorithms that do not accept a key.
Reported by: Yuval Kanarenstein <email@example.com>
Reviewed by: cem
MFC after: 1 week
Sponsored by: Chelsio Communications
Differential Revision: https://reviews.freebsd.org/D23094