Session key for AES-256-encrypted USB communication

[douglasbakkum]

Allow using an ephemeral session key such that the client app does not need to store the device password for either the standard or hidden wallet. This also provides some backward privacy. The session key is optional, such that the PR is backward compatible with the existing desktop app that does not use a session key.

API

command
{"session" : "set"}

reply
{"session" : "__password__"}
The returned session password is random and in hexadecimal format. It is valid until the device is unplugged or if "set" again or turned "off" (see below). Access through the standard or hidden password is disabled while a session password is activated.

--

command
{"session" : "off"}

reply
{"session" : "success"}
Resumes access through the standard or hidden password.