Abort on invalid IV size

Previously, if the size of the IV did not match the block size
mcrypt would throw a warning and fall back to a NUL IV. This
behavior is both dangerous and makes no practical sense.

mcrypt_encrypt etc. will now return false if the IV has an incorrect
size.
Abort on missing IV if the enc_mode requires it

Previously the code fell back on using a NUL IV if no IV was
passed and the encryption mode required it. This is dangerous and
makes no sense from a practical point of view (as you could just
as well use ECB then).
Abort on invalid key size

Previously an incorrectly sized key was either silently padded
with NUL bytes or truncated. Especially the silent nature of this
behavior makes it extremely easy to use weak encryption. A common
mistake - which has also been extensively made in our tests - is
to use a password instead of a key.

Incorrectly sized keys will now be rejected.
Clean up do_crypt code

Avoid unnecessary alloc/copy/free cycles and clean up structure in
general. Add a few extra checks for the key length.
Print supported key sizes in error message
Call mcrypt_module_close on error
Provide expected IV length in IV error messages
Remove a number of macros that are no longer used
Use zpp for accepting encryption mode string

Leaving the non-zpp usage for the mcrypt_{MODE} functions, as
they're deprecated and I'm too lazy to update all their tests.
Add NEWS entry for mcrypt changes