Fix compilation with locks disabled
Fix a math mistake in the spec
Add a hopefully compatible implementation in Haskell

I wrote this from the specs, trying to stay as close to the specs as
possible.

This is not good Haskell; I haven't written any Haskell since 1998,
and my knowledge is pretty spotty.

It's also a bad crypto implementation -- it does nothing to avoid
side-channel attacks, nothing to wipe sensitive data, and it's totally
unoptimized.

It's also totally untested.

My end goal here is not to have a Haskell libottery implementation for
real use, but rather to have another implementation of the spec that I
can use to make sure that the main implementation follows the spec.