secio, spipe replacement

This PR introduces secio, the replacement to spipe.

- use io.ReadWriter instead of channels + async workers
- decrypt in place (can't encrypt in place, input mangling)
- Encrypt-Then-Mac io.ReadWriter
- a nifty cmd/seccat to try it out! crypto chat with friends!
- commented everything
- improved readability
- improved security:

(1) changed the third message to be the random nonce sent by
    the remote party.

(2) determine order based on identities AND the random nonces,
    which makes it **very** unlikely to fail.

and more
Since the `BufPool` is exposed, may want to safe-cast. The person replacing the BufPool may not be aware of this type requirement.