Extend SHA2 implementation to support generic-length truncation

[marsella]

Right now, we're planning to implement SHA2 per FIPS 180-4 for only the fixed-length algorithms defined in the spec (SHA-224, -256, -384, -512, -512/224, and -512/256). However, the spec also has details on implementing a SHA-512/$t$ for an arbitrary truncation length $t$. We'd like to support this functionality, too.

• Identify which parts of the spec need to change to add support for t (e.g. initial hash value in 5.3.6). Update this ticket with a list
• Implement the changes
• Find test vectors for some sample lengths and implement them.