use of hashlib.sha1 causes issue in FIPS build

[davidism]

Some FIPS builds are going beyond the standard and disabling SHA-1 (rather than just strongly discouraging its use). ItsDangerous accesses hashlib.sha1 on import in order to set a default, which immediately fails since sha1 isn't available in these builds. Make its access lazy so users have time to override the default. SHA-1 remains safe to use in HMAC, so the default will not be changing.