Improve the NIST KDF

Using the XOR of the outputs as the IV makes more sense than using it as the Context parameter. This is more efficient and avoids a suffix MAC situation.

However, with SHAKE256, SHA3-512, and BLAKE3, the current PRF input still exceeds one block. I think keeping the counter and domain separation is a good idea though so will probably have to live with this.

draft-lucas-bkdf.md

@@ -282,10 +282,10 @@ foreach output in outputs
 
 counter = 1
 reps = Ceiling(length / HASH_LEN)
-previous = ByteArray(0)
+previous = hash
 result = ByteArray(0)
 for i = 0 to reps
-    previous = PRF(key, previous || LE32(counter++) || UTF8("bkdf") || hash)
+    previous = PRF(key, previous || LE32(counter++) || UTF8("bkdf"))
     result = result || previous
 
 return result.Slice(0, length)