Fixes incorrect MD5 calculation in cram_write_SAM_hdr

This fixes https://github.com/samtools/htslib/issues/67

cram_write_SAM_hdr adds a @SQ M5 tag if not already present.  When doing
this, if the reference had not already been loaded it would incorrectly
pass rlen = 0 to MD5_Update, resulting in it calculating the MD5 of an
empty file.  This patch updates rlen after the reference has been loaded
so the correct MD5 is calculated.

It also adds a check for cram_get_ref returning NULL, and calls cram_ref_decr
earlier to prevent a possible memory leak if sam_hdr_update returns non-zero.