More code path test coverage

Added test coverage for untested code paths (mostly error handling) revealed by 'go tool cover'.
Rather than make decryptGarbage read stuff from rand and then decrypt, how about just reading the buffer once and then calling decrypt:

    func (*cryptoSuite) TestBadCiphertext(c *gc.C) {
        buf := randomBytes(nonceLen + secretbox.Overhead)
        for i := 0; i < len(buf); i++ {
            _, err := decrypt([]byte("a key"), buf[0:i])
            c.Assert(err, gc.ErrorMatches, "message too short")
       }
       _, err := decrypt([]byte("a key"), buf)
       c.Assert(err, gc.ErrorMatches, "decryption failure")
    }

    func randomBytes(n int) []byte {
        read n random bytes from rand.Rand, panic on error
    }

It might also be good to do the same test when the ciphertext
is valid but truncated.