Fixes #1200 -- disallow GCM truncation by default

Since you can now pass 0 here you can pass an empty string as tag, which will cause an assertion failure in the OpenSSL backend. This was prevented previously by having a minimum tag length. Maybe we should still enforce it being >= 1?