fix typos in state table
re-work the security protocol

Use ChaCha20 as the stream cipher instead of XSalsa20. ChaCha20 seems to be
gaining momentum as the new stream cipher de jure having been added to OpenSSH
and being poised for addition to TLS. The extra nonce size of XSalsa20 isn't
necessary since we're generating a new key for every connection. ChaCha is also
slightly faster than Salsa.

Use a fixed initial value for the nonce. A unique key is generated for each
connection so the nonce does not need to be randomized.

Implement the authenticated crypto in place of MSE/PE below the BitTorrent
message stream rather than as an extension message. This is more convenient to
implement in libtorrent and probably other implementations as well. It also
avoids the absurdity of double encrypting traffic with both RC4 and ChaCha.

Specify the AEAD construction exlicitly rather than deferring to libsodium. The
only difference aside from using ChaCha in place of XSalsa is that the last 32
bytes of the first block of cipher output are discarded rather than used to
encrypt the first 32 bytes of plaintext. This makes is easy to remove the
requirement that the plaintext have an extra 16 bytes of otherwise useless
padding.