Change sensitive strbufs/sgrowarrays to the new _nm version.

The _nm strategy is slower, so I don't want to just change everything
over no matter what its contents. In this pass I've tried to catch
everything that holds the _really_ sensitive things like passwords,
private keys and session keys.

sshhmac.c

@@ -110,7 +110,7 @@ static void hmac_key(ssh2_mac *mac, ptrlen key)
          * the underlying hash, then we start by hashing the key, and
          * use that hash as the 'true' key for the HMAC construction.
          */
-        sb = strbuf_new();
+        sb = strbuf_new_nm();
         strbuf_append(sb, ctx->hashalg->hlen);
 
         ssh_hash *htmp = ssh_hash_new(ctx->hashalg);