use ffi.dlopen(), instead of .verify(), so it can work after install

With dlopen(), the CFFI-generated .so contained the hard-coded path of
the (temporary) libsodium.so file from the build directory. At runtime,
that libsodium.so was gone.

Using dlopen() means:
* we can't extract constants, so must call getters instead
* we can't mutate the raw lib object, so we wrap it
* we can't use .get_extension() to play nicely with distutils ext_modules

But it seems to work. I don't yet know if that last point will cause
problems.