Switch to NonleakyMd5

Both md5.New().Sum() and md5.Sum() leak information about the
internal state in one way or the other:

* md5.New().Sum() creates a temporary copy of the hasher (which is
  not accessible after the function returns).
* md5.Sum() creates a temporary hasher (which is not accessible
  after the function returns).
* md5.checkSum() uses a temporary buffer (which is not accessible
  accessible afterwards)
* md5.New().Reset() does not zero digest.x

So, to solve the problem of leaking bits, we switch to a small variant
of crypt.Md5 called 'NonleakyMd5', see md5.go for implementation
details. It get's access to the internal fields via 'reflect' and
cleans the memory properly in .Reset().