hmac: add `HashMismatchException`

not used internally, but handy for consumers who want to throw
exceptions