[crypto] Add assertion on HKDF output length

The security proof for HKDF requires each HMAC hash within the
iteration to be computed over distinct input values.  The 8-bit
counter values (ranging from 0x01 to 0xff) provide this formal
guarantee as long as the overall output length is no more than 255
hash blocks.

Even if the counter is allowed to wrap, output is vanishingly unlikely
to repeat since each block's input value also includes the output from
the previous block.  However, this is not a formal guarantee.

RFC 5869 mentions the output length constraint only in passing and in
parentheses.  HKDF is intended to be used to produce small quantities
of key material, and so no realistic consumer will ever exceed the
output length constraint (which is almost 8kB for SHA-256).

There is no point in making this a runtime check.  Doing so would
require every hkdf_expand() call site to include a completely
unnecessary error handling code path, for no real benefit.

Add an assertion to indicate that we are aware of the constraint, and
to reduce future review noise.

Signed-off-by: Michael Brown <mcb30@ipxe.org>