[noise] BLAKE2X as KDF

[Jason A. Donenfeld]

Hey Trevor,

I thought I'd revisit this, now that https://blake2.net/blake2x.pdf is
finished. From the looks of this specification, it seems exactly
designed as a replacement for HKDF. Not only does it give a speedup,
but it also makes Noise easier to implement, since it seems feasible
that Blake2 libraries won't have an HMAC function. It seems like the
change to Noise would be fairly straight-forward too. If you're using
one of the SHA2 modes, you use HKDF. If you're using one of the Blake2
modes, you use Blake2x. Each function family with its associated KDF.

Second time considering it is a charm, perhaps?

Jason