ensure valid cSHAKE length

[panva]

Ensure's valid cSHAKE length in our op steps.

Originally posted by @panva in #41 (comment)

---

Preview | Diff

[twiss]

Section 3 of NIST-SP800-185 says:

When the requested output length is zero, i.e., L=0, cSHAKE, KMAC, TupleHash, and ParallelHash return the
empty string as the output.

So, I would prefer to just follow that rather than forbidding it here.

Additionally, the output length parameter is defined as a number of bits, and the output is well-defined in that case. However, we don't clearly define what to do here, since we return a byte sequence rather than a bit sequence. But, we already have a convenient helper for that, namely a byte sequence containing a bit sequence. So, we can just use that instead of forbidding this as well, IMHO. I'll write a patch for that.

[panva]

cc @Frosne as this was originally your request for turboshake

[Frosne]

Ok!

[twiss]

(Closing in favor of #51, but let me know if there are any objections to the text there ofc 😊)