Add HMAC support

[cemerick]

Friend should support HMAC in conjunction with any other credential function; obviously starting with the bcrypt that is currently shipped.

Appeals to authority include @abedra's friendly evisceration of typical Clojure webapp security practices ;-) and Mozilla's password storage guidelines.

Related work may include a "crypto-hmac" library as suggested by @weavejester here, though it looks like that was speculative?

[zonotope]

@cemerick it doesn't look like a crypto-hmac library was ever written. what do you think of using pandect?

[abedra]

That actually seems reasonable. It wraps bouncy castle underneath, which is a respectable choice. I didn't look closely at the implementation yet, but the idea seems sound.