aead: marker trait + simpler encryption API for randomized nonces

[tarcieri]

We currently require an explicit nonce for all encryption APIs, including ones which automatically encode the nonce as part of the AEAD message.

For some AEADs we can use purely randomized nonces safely: AES-GCM-SIV, the XChaCha* variants, and the new XAES-256-GCM are all examples of AEAD algorithms which are safe to use with nonces derived from a CSPRNG.

For these constructions, it would be nice if we had APIs that completely delegate nonce generation to a CSPRNG so we could more easily avoid nonce reuse.

[tarcieri]

As discussed in #1713, the encryption API can also wrap up prepending the random nonce to the message, as is customary.

[newpavlov]

Are there any protocols used in practice which append nonces to ciphertext?

We potentially could add an inout type with reserved header of fixed size. It also could be useful for a more efficient set of prefix encrypt/decrypt methods.