Evaluate panics on MD5 entries #44

An entry with algorithm MD5 makes Evaluate panic for about 3 in 16 codes:

panic: runtime error: index out of range [3] with length 2

The truncation offset is hashed[h.Size()-1] & 15, so it can be up to 15. That's fine for SHA1, SHA256 and SHA512, but an MD5 digest is only 16 bytes. At an offset of 13, 14 or 15 there are fewer than 4 bytes left for binary.BigEndian.Uint32. For TOTP it depends on the time window, so the same entry works for a while and then crashes. -eval exits, and with -http the /events stream drops the connection.

HOTP entry with secret 00 01 02 03, which hits offset 14 on the first code:

otpauth -eval -link "otpauth-migration://offline?data=ChcKBAABAgMSCW1kNS1lbnRyeSAEKAEwARABGAE%3D"

Found with a fuzzer, tested on v0.6.1.

RFC 4226 and 6238 don't say how to truncate a 16 byte digest, so there's no reference code for those offsets. Clamping the offset to len(hashed)-4 stops the panic and keeps every code that works today the same. I'll open a PR with that, but if you'd rather handle MD5 another way, that works for me.