decrease our estimate if we're not fully-seeded and we output random values
do less iterations of PBKDF2 if we're already fully-seeded, to avoid UI blocking - still do it as a countermeasure in case the user-supplied seed was not good
To properly protect against a bad system RNG, we need user entropy for ISAAC,
but this incurs a cost for every reload of the page. In practice, people might
be tempted to set allow_weak, but that's not what that flag is for. Ultimately,
this is an issue that is not ours to solve - it should be solved in the layers
below us. This commit relaxes things a bit:

- in getValues(), we assume the system RNG is secure, and say this in its
  documentation. We'll continue to mix in ISAAC, and use weak_seed(), to make
  life more difficult for the attacker in case the system RNG is not secure [1]

  - but, importantly, we do not make any contractual guarantees towards the
    effectiveness of that countermeasure.

- in seed(), we don't assume the system RNG is secure, so people can seed it
  properly in critical cases like generation of long-term keys. We use entropy
  estimates to detect bad seeds, but not to guarantee the security of seeds.

The end result is:

- use-cases that don't want to rely on the system RNG, can collect entropy
  and call seed().

- use-cases that are happy to risk a bad system RNG, can avoid the step of
  collecting entropy. users without a system RNG will get an error, however.
  (notably, IE10 and below, see [2])

- use-cases that set allow_weak will work with no extra input, as before.

As opposed to the current situation, where everyone is forced to collect
entropy, unless they set allow_weak.

[1] https://en.wikipedia.org/wiki/Dual_EC_DRBG
[2] https://developer.mozilla.org/en-US/docs/Web/API/window.crypto.getRandomValues

https://github.com/vibornoff/asmcrypto.js/issues/27