Avoid buffer overrun on encryption

Make sure we null-terminate encrypted strings before passing them to
UTF8ToString.

This used to work when we allocated the buffer on the stack, because it turns
out that allocate() zeroinits the returned memory. malloc(), of course, does
not.

Allocate memory for message blobs on the heap

Avoid leaving copies of the plaintext sitting around in the emscripten heap.

Better handling of exceptions during loading, and import OLM_OPTIONS

Messages can be very large, so we don't really want to allocate them on the
stack. Switch to using the heap for them, and try to clean up some of the
string handling while we're at it.

Read settings from OLM_OPTIONS to allow apps to configure some options. In
particular, this is useful for setting the heap size.

If we get an exception during load, don't define half of window.Olm (which
confuses apps).

This is a partial fix to https://github.com/vector-im/riot-web/issues/2726.

fuzz_group_decrypt.cpp got broken by 653790ea; fix it up

Return the base64-encoded length of pickles

Document the potential for message replays and possible mitigations

make olm_pickle_* return the lengths of the base64-encoded pickles, rather than
the raw pickle. (From the application's POV, the format of the pickle is
opaque: it doesn't even know that it is base64-encoded. So returning the length
of the raw pickle is particularly unhelpful.)

All the other methods clear their random inputs. This one needs to do the same,
to reduce the risk of the randomness being used elsewhere and leaking key info.

Return the message index when decrypting group messages.

Add notes on limitations to megolm spec

Applications can use the index to detect replays of the same message.

We're standardising on 'one-time keys' as a term for the thing that Bob uploads
for prekey messages.

Fix a buffer bounds check when decoding group messages

Add a README for the fuzzers