Revise our handling of the zeroize trait

This branch introduces an actual set of rules about when we want things to be Zeroize, and a helper type to manipulate a Zeroize<Vec<u8>> safely, and starts using them in our crypto code.

This is not perfect, but neither is zeroize: there are probably some more things we should zeroize, and there are definitely dependencies we have that do not zeroize their types well. (See #529)

Closes #254 (closed).