Add a test for chacha20

This test is copied from the test I wrote for libottery.  We
generate known-good values in python, and then make sure they match
the values from our chacha implementation.

I know this python implementation is okay, because it matches the
outputs from the krovetz and reference implementations.
Fix all the chacha bugs

Yeah, looks like that wasn't chacha:
  * You have to add in the original state after all the rounds are
    done, and
  * you have to actually xor the right stuff in the quarter-round
    function, and
  * you have to put the counter before the nonce, and
  * the counter is supposed to be little-endian.

Two of these are cryptographically relevant.