HMAC/SHA1 implementation

I've taken #23 and merged it into a single commit (since IIRC the commits there don't make sense to preserve). I've also made two changes of my own that I think make it slightly cleaner.

While the single-valued return value is potentially more future-proof, I think having that in the code now does not actually help. Since we don't really have a stable API surface here, we can always add it as soon as we need it.

Since the HMAC code has no other ties to APR than that it uses the APR implementation of SHA1, I'm not sure why it makes sense to name it with APRX everywhere here, since it'll just be maintained in this codebase.

@gozer-mozilla, does that make sense?