Improve hashing speed

[burdges]

We almost always use merlin for hashing, but merlin is not optimized for large amounts of data, thus making SigningTranscript::bytes slow. We should look into blake2x and/or develop a chacha based strobe variant and/or encourage using the SigningTranscript::hash256 method instead. See paritytech/substrate#2415

[burdges]

I've added a warning on the bytes method. We'll add benchmarks eventually and then compare with SimpleTranscript<Shake128> and eventually SimpleTranscript<Blake2x> if RustCrypto/hashes#83 happens.

[burdges]

Aside from either using Blake2x directly or doing a ChaCha variant of STROBE. We could give Keccak STROBE a fast mode, likely along the lines of KangarooTwelve. See debris/tiny-keccak#41

[burdges]

I'm going to close this since the ship sailed and we're using merlin now. :)