fortuna: Always initialize cipher state

In strange environments (such as freestanding or kernel environments),
gettimeofday() may be broken or neutered such that enough_time_passed()
might return false on the first call (comparing against a last_reseed_time of
all zeros).  This would skip the initial cipher state initialization
in reseed(), and calling into the rijndael code with uninitizlied state
(in particular, 'rounds' set to zero) results in a non-terminating loop
that eventually crashes the application.

To remedy this, always call reseed() from extract_data() when it
has never been called before, so that the cipher state gets initialized
before it is used.

Leave a comment in init_state() indicating why the initialization of
cipher state is delayed to reseed().