Document what we use for KH when we're doing ntor.

KH is part of the material derived from the KDF during the onion key
process.

In the TAP handshake, KH played two roles: it was sent by the server
towards the client to prove that the server was able to complete the
TAP handshake, AND it was included as part of the
RELAY_ESTABLISH_INTRO message to make it impossible to replay a
RELAY_ESTABLISH_INTRO from one circuit on another circuit.

With the ntor handshake, the first value of KH was removed.  But we
still needed a shared, circuit-specific value for hidden service
code to work.  This value is taken as an additional 20 bytes from
the KDF.  It wasn't documented in the spec, though.  Adding it here.