MFC 356561: Add stricter checking on mac key lengths.

Negative lengths are always invalid. The key length should also
be zero for hash algorithms that do not accept a key.

admbugs: 949