Fixed GOST_PK_FORMAT param

Reported-by: Gleb Fotengauer-Malinovskiy <glebfm@altlinux.org>

Openssl is already have output result size in EVP_MD.md_size
We should not exceed its value when writing digest output.
This should be fixed more consistently, probably, by removing
dgst_size from OMAC_CTX.

Openssl copies a state between valid contexts. But, EVP_MD_CTX_copy_ex
just memcpy-s private data (md_data), which points to OMAC_CTX), which
have pointer to CMAC_CTX. Copying pointer makes CMAC context just the
same on the both sides. As a consequence, we can not do normal copy of a
state between CMAC contexts. As a fix, we just clone it if it's equal
between copy sides.

Reported-by: Gleb Fotengauer-Malinovskiy <glebfm@altlinux.org>

ACPKM-Master is from R 23565.1.017-2018, it will be required for
ACPKM-OMAC for TLS 1.2.

Default limit for Kuznyechik is 4KiB, from TLS 1.2 recommendations. As
a consequence it does not need to be configured via EVP_CTRL_KEY_MESH.
Also, explicitly set ACPKM limit in tests.

Two reasons: to match GOST R test vector size, just make it bigger.

openssl-1.1.0 made ctx opaque and does not allow it on stack anymore.

Previously, we had shim layer in our openssl branch
Could be squashed with 01d26132

Co-authored-by: Mikhail Gordeev <obirvalger@altlinux.org>

Also, document why CTR IV size is now set to 16, so user is noted to set
IV appropriately to full extent (including counter). Basically, it's for
openssh (and alike) to make it copy IV from privilege separated process.