Pull in a SHA-3 implementation.

We'll need it sooner or later, particularly because SHAKE128/SHAKE256 are incredibly handy for what they do, and having a cryptographic hash that's immune to length extension attacks simplifies some of our constructs.

I have a modified version of keccak-tiny (https://github.com/coruus/keccak-tiny) that provides more familiar semantics that I can clean up for inclusion.