Fix two bugs with CommonCrypto GCM that can result in invalid output.

Bug 1: Call to AAD but no call to update. Get null tag bytes.
Bug 2: Call to update without call to AAD. Get null ciphertext bytes.

These bugs are ridiculous so there are comments added to try to help us avoid confusion in the future...

Fixes #1329
I need to check my radar list. I'll drop radar numbers in the comments here too.