[noise] XXfallback: es vs se

[Scratch]

I was implementing XXfallback pattern for Go and it took longer than
expected because of 2 things that I'd like to mention

1) It's totally unclear that from the point of view of responder (ex
initiator) who composes the last mesage the last token is actually se,
not es.
BTW in Trevor's Rust implementation it's also se. I've read the spec
several times and found no mention of "reversing" some tokens in case
responder becomes initiator and vice versa. Thanks to java
implementation, I found out that se/es token can mutate into each
other. I also don't understand why the first message (-> e, ee, s, se)
works as without changing se to es.

So in my case all these
(https://github.com/rweather/noise-c/blob/master/tests/vector/noise-c-fallback.txt)
tests pass when the pattern looks as follows:

Noise_XXfallback(s, rs, re):
  <- e
  ...
  -> e, ee, s, se
  <- s, se


I'm sure this can be described in a more understandable way

2) Also took me a while to find out that in case PSK exists we should
also pre-mix e into key. My bad, but I'd add a reference to it to
XXfallback description