aead: split Aead(Mut) from Aead(Mut)InPlace (fixes #70)

Splits the `Aead` and `AeadMut` trait into the following:

- `Aead` and `AeadMut`:gated on the `alloc` feature
- `AeadInPlace` and `AeadMutInPlace`: object-safe, always available

This further has the benefit that implementors who don't want to provide
or abstract over the in-place APIs no longer have to.

To make the `*InPlace` traits object safe, the one generic parameter
they previously used (`impl Buffer`) was switched to `dyn Buffer`.
This adds some vtable dispatch overhead for manipulating the buffer, but
hopefully it is still cheap compared to the overhead of cryptographic
operations on the underlying data. That said, no benchmarks have been
performed (yet) on the costs of this change.

Author: tarcieri