hash: clear HMAC states after use #1967

The RFC6979 initialize and generate functions in hash_impl.h never clear their local HMAC states, so the last one stays on the stack after a nonce is derived. It holds an intermediate V and an inner digest, not the secret key or the message, and the nonce cannot be recomputed from them without K, which the callers clear. secp256k1_hmac_sha256_clear exists since #1579 but has no caller.

This PR clears each state after its last use, and also the SHA256 state that hashes an HMAC key longer than 64 bytes. I added no test. A throwaway program that scans the stack after secp256k1_nonce_function_rfc6979 finds one copy of V before this change and none after, at -O0, -O1 and -O2.

Tested ACK 13726d4 on Windows.

Concept ACK

Clearing is in principle the right thing to do even though it's overkill here under the assumption that the attacker can't invert SHA256. But this is just because HMAC itself is overkill, and this is an entirely different discussion

Concept ACK

ACK 13726d4dfaf3f54ed4f4c8ce66110700df10e648