aead: marker trait + simpler encryption API for randomized nonces

[tarcieri]

We currently require an explicit nonce for all encryption APIs, including ones which automatically encode the nonce as part of the AEAD message.

For some AEADs we can use purely randomized nonces safely: AES-GCM-SIV, the XChaCha* variants, and the new XAES-256-GCM are all examples of AEAD algorithms which are safe to use with nonces derived from a CSPRNG.

For these constructions, it would be nice if we had APIs that completely delegate nonce generation to a CSPRNG so we could more easily avoid nonce reuse.