Relax most __attribute__ ((nonnull)) to allow 0-length inputs to be NULL.

Justifications:
- crypto_(auth|hash|generichash|onetimeauth|shorthash)*:
  it's legal to hash or HMAC a 0-length message
- crypto_box*: it's legal to encrypt a 0-length message
- crypto_sign*: it's legal to sign a 0-length message
- utils:
  comparing two 0-length byte arrays is legal
  memzero on a 0-length byte array is a no-op
  converting an empty hex string to binary results in an empty binary string
  converting an empty binary string to hex results in an empty hex string
  converting an empty b64 string to binary results in an empty binary string
  converting an empty binary string to b64 results in an empty b64 string
  sodium_add / sodium_sub on zero-length arrays is a no-op

For the functions declared in utils.h, I moved the logic into private functions that
have the __attribute__ ((nonnull)) check, but they are only called when the
corresponding length argument is non-0. I didn't do this for the hash/box/sign
functions since it would have been a lot more work and quite a large refactor.

test/default/auth.c

@@ -14,12 +14,14 @@ static unsigned char key2[] =
 
 static unsigned char a[crypto_auth_BYTES];
 static unsigned char a2[crypto_auth_hmacsha512_BYTES];
+static unsigned char a3[crypto_auth_hmacsha512_BYTES];
 
 int
 main(void)
 {
     crypto_auth_hmacsha512_state st;
     crypto_auth_hmacsha256_state st256;
+    crypto_auth_hmacsha512256_state st512_256;
     size_t                       i;
 
     assert(crypto_auth_hmacsha512_statebytes() ==
@@ -65,6 +67,58 @@ main(void)
             printf("\n");
     }
 
+    // Empty message tests: HMAC-SHA512
+    memset(a2, 0, sizeof a2);
+    crypto_auth_hmacsha512_init(&st, key, sizeof key);
+    crypto_auth_hmacsha512_final(&st, a2);
+
+    memset(a3, 0, sizeof a3);
+    crypto_auth_hmacsha512_init(&st, key, sizeof key);
+    crypto_auth_hmacsha512_update(&st, a2, 0U);
+    crypto_auth_hmacsha512_final(&st, a3);
+    assert(sodium_memcmp(a2, a3, sizeof a2) == 0);
+
+    memset(a3, 0, sizeof a3);
+    crypto_auth_hmacsha512_init(&st, key, sizeof key);
+    crypto_auth_hmacsha512_update(&st, NULL, 0U);
+    crypto_auth_hmacsha512_final(&st, a3);
+    assert(sodium_memcmp(a2, a3, sizeof a2) == 0);
+
+    // Empty message tests: HMAC-SHA512-256
+    memset(a2, 0, sizeof a2);
+    crypto_auth_hmacsha512256_init(&st512_256, key, sizeof key);
+    crypto_auth_hmacsha512256_final(&st512_256, a2);
+
+    memset(a3, 0, sizeof a3);
+    crypto_auth_hmacsha512256_init(&st512_256, key, sizeof key);
+    crypto_auth_hmacsha512256_update(&st512_256, a2, 0U);
+    crypto_auth_hmacsha512256_final(&st512_256, a3);
+    assert(sodium_memcmp(a2, a3, sizeof a2) == 0);
+
+    memset(a3, 0, sizeof a3);
+    crypto_auth_hmacsha512256_init(&st512_256, key, sizeof key);
+    crypto_auth_hmacsha512256_update(&st512_256, NULL, 0U);
+    crypto_auth_hmacsha512256_final(&st512_256, a3);
+    assert(sodium_memcmp(a2, a3, sizeof a2) == 0);
+
+
+    // Empty message tests: HMAC-SHA256
+    memset(a2, 0, sizeof a2);
+    crypto_auth_hmacsha256_init(&st256, key, sizeof key);
+    crypto_auth_hmacsha256_final(&st256, a2);
+
+    memset(a3, 0, sizeof a3);
+    crypto_auth_hmacsha256_init(&st256, key, sizeof key);
+    crypto_auth_hmacsha256_update(&st256, a2, 0U);
+    crypto_auth_hmacsha256_final(&st256, a3);
+    assert(sodium_memcmp(a2, a3, sizeof a2) == 0);
+
+    memset(a3, 0, sizeof a3);
+    crypto_auth_hmacsha256_init(&st256, key, sizeof key);
+    crypto_auth_hmacsha256_update(&st256, NULL, 0U);
+    crypto_auth_hmacsha256_final(&st256, a3);
+    assert(sodium_memcmp(a2, a3, sizeof a2) == 0);
+
     assert(crypto_auth_bytes() > 0U);
     assert(crypto_auth_keybytes() > 0U);
     assert(strcmp(crypto_auth_primitive(), "hmacsha512256") == 0);