Noassert

Fixup assert work in CCM; input data length is handled through the natural `option`, nonce length as `Invalid_argument`. Leaving the assert in `flags` for now.

@hannesm Can you please cross-check my thinking?