Redirect x/crypto APIs to implementations provided by backends for FIPS compliance

[dagood]

• Plan integrating SHA3 functionality #967 is a specific request, although hash functions can be treated as a special case (registration at runtime) that might have a simpler solution than a general approach.
• https://golang.org/x/crypto/pkcs12 and https://golang.org/x/crypto/hkdf are interesting.

x/crypto is used without a simple alternative in code that needs FIPS support. To keep up with the goal of possible FIPS compliance without source code changes, we should find a way to replace x/crypto APIs with implementations backed by OpenSSL/CNG. (At least actively used ones.)

A general solution is also touched on in microsoft/go-crypto-openssl#57 (comment).