Clarify message about incorrect length in the counter block.

When the counter function returns an incorrect counter block to
the cipher in CTR mode, the error message includes both the required and
the provided amount of data (in bytes).
Added support for CCM mode (AES cipher only)
Added CCM tests

Added vectors from NIST SP 800-38C and tests to verify lengths of IV and
MAC tag are checked correctly.
Fix description/design of AEAD API.

With SIV (RFC5297), decryption can only start when the MAC is known.
The AEAD API does not support that.

In this proposal, for SIV the MAC is exceptionally passed together
with the ciphertext to the decrypt() method.
Add MacMismatchError and ApiUsageError

When verify() detects that the MAC is incorrect,
it will issue a user-defined MacMismatchError exception
and not the standard ValueError mismatch.

When a method of a Cipher class is invoked while it shouldn't be,
it will issue a user-defined ApiUsageError. Incorrect
parameters still raise a ValueErorr exception.