Add support for timeout notification callbacks.

When building an application (such as a server) that uses multiple
messagers, managing calls to curvecpr_messager_next_timeout() can be
tedious. This change introduces an optional callback-based mechanism for
handling updates to timeouts.

Also, there's a CHANGELOG now.
Use libsodium 0.4.3 and pkg-config.