Add a test for blake2b/s

The test vectors are taken from the blake2 reference implementation
source, and are also CC0-dedicated.
Fix the blake2[sd] implementations

 * Add a parenthesis to (n) on the ROT macro.  Not actually needed.
 * Use blake2b on hypothetical 128-bit architectures.
 * Form the initial h value correctly.
 * Use BLAKE2_IV7 for the last initial word of h[]; BLAKE2_IV6 is
   for the next-to-last word.
 * Always run the compression function at least once.
 * Increment the counter *before* each block, not after.

At least one and maybe three of these are cryptographically relevant.