Stabilize the PRF we use for internal purposes

[cjpatton]

We use a PRF for a couple of internal functions:

1. Map a report to a shard of the ReportsPending and ReportsProcessed DOs
2. draft02: Generate collection job IDs

We are currently using PrgAes128 for this purpose, which is deprecated as of VDAF-05. As of #259 we will use PrgSha3, which is the new default as of VDAF-05. This is a breaking change, since the generated values will change. In fact, PrgSha3is likely to change in backwards incompatible ways in future drafts: see cfrg/draft-irtf-cfrg-vdaf#209.

In order to reduce the number of crypto dependencies, we were hoping to reuse something that we already need for VDAF. But since this is still a moving target, we ought to consider using something like HMAC-SHA256.