refactor key-setup/encryption code to prepare for new protocol versions

To support https://github.com/magic-wormhole/magic-wormhole-protocols/issues/46 , I'm going to rewrite the client's key-setup code. This is the code that generates and processes the PAKE and VERSION messages, to compute and confirm a session key.

Currently this is spread across several state machines: Key, SortedKey, Receive, Send, and Order. I plan to merge those all together. I'm also planning to move the core logic into a sans-io -style EncryptionCore class, which communicates by returning enumerated events to process rather than invoking other state machines directly.

I also intend to extract the actual key-setup logic into a new "Negotiation" class, and call it Negotiate_V0. My plan is to retroactively assign the name "v0" to the existing SPAKE2-only key-setup protocol, so that 1: we have something to talk about when we move to newer protocols, and 2: peers can fall back to it when both sides are unable to support something better.

I'm expecting to create a "v1" protocol that is also SPAKE2-only but improves the transcript hashing. This will also give us some practical experience with protocol upgrades before moving to the new post-quantum stuff in "v2".