symm/sha512.[ch], etc.: Support SHA512/224 and SHA512/256.

These are more truncated versions of SHA512 with different initial
values.  The point of the exercise is performance: SHA512 runs faster
than SHA256 on 64-bit processors (it munches twice as much data per run
through the compression function, but has only 25% more rounds).  Add
test vectors for the hash function from NIST and Wikipedia, and HMAC
tests I found under a rock.