Delay KangarooAbsorb until needed, to avoid 168 erroneous 0-byte-padding

[jonmv]

This PR fixes an error in the KangarooTwelve hashing algorithm, where inputs of certain lengths are erroneously padded with 168 0-bytes, when they should not be. The problem is too eager absorption of queued data into the "sponge", missing the fact that 0-bit padding inside the current last byte would be sufficient padding. The reference implementation in the original paper (https://keccak.team/files/KangarooTwelve.pdf) was used to verify the changed algorithm, together with the C++ library from the xkcp package, and another open golang implementation.

The fix is to avoid too eagerly absorbing queued data, on queue fill-up, which would be wrong if there were no more data to be written, and the 10*1 bit-padding should complete within the same byte as the one which contains the start of the padding. This bug would trigger when, e.g., a buffer of 166 bytes, and an empty personalisation string, was hashed, where the write of the SINGLE delimiter would fill the data queue, and be immediately absorbed, followed by an explicit pad-and-squeeze, which would then add another 168 0-bytes, with the final bit set. The correct would instead be to set the final bit of the buffer after adding the SINGLE delimiter, and then absorb that.