* Factor redundant code in std/crypto/chacha20

* Add support for XChaCha20, and the XChaCha20-Poly1305 construction.

XChaCha20 is a 24-byte version of ChaCha20, is widely implemented
and is on the standards track:
https://tools.ietf.org/html/draft-irtf-cfrg-xchacha-03

* Add support for encryption/decryption with the authentication tag
detached from the ciphertext

* Add wrappers with an API similar to the Gimli AEAD type, so that
we can use and benchmark AEADs with a common API.