Start on issue #2: randomly pad the message.

Along the way, discover that there's a validation bug when encrypting
very large files.  This bug that was masked by the fact that Python's
bzip2 compressor often doesn't produce any output until it flushes; as
a result, Configuration._consolidate_used_ranges() never had a chance
to wrongly claim incoherent range reconsumption when consolidating,
which it would otherwise do, because PadEncoder.pad.convert() and
especially PadEncoder.config.record_consumed() are only called once,
in PadEncoder.finish(), not in PadEncoder.encode(), because the
compressor never offers any output in the latter.

So this commit is really about tidying up the code and writing a
regression test, in preparation for fixing *that* bug, after which
we'll return to fixing issue #2.

* onetime
  (Pad.__doc__): Document that Pads are per-session.
  (Pad.offset): Fix tense in doc string.
  (Pad.PadUninitialized): New error class.
  (Pad.convert): Raise an error if offset hasn't been set yet.
  (Pad.read): New method.
  (PadEncoder.__init__): New self.used variable, initialized to False.
  (PadEncoder.encode): Only consume pad if there is compressed
    plaintext available.  This doesn't fix the validation bug referred
    to above, but it highlights the circumstance that produces the bug
    and makes debugging easier.

* check.sh
  ("encryption, decryption of large plaintext"): New xfail test.