The third-party library that adds support for this to Python 3.5 is a
binary package, and thus breaks the pure-Python nature of Python-RSA.

This should fix [#147](https://github.com/sybrenstuvel/python-rsa/issues/147).

The newer versions always have a message, even on success.

Reject cyphertexts that have been modified by prepending zero bytes, by
checking the cyphertext length against the expected size (given the
decryption key). This resolves CVE-2020-13757.

The same approach is used when verifying a signature.

Thanks Carnil for pointing this out on https://github.com/sybrenstuvel/python-rsa/issues/146

This is based on https://github.com/sybrenstuvel/python-rsa/pull/96, with
a few improvements:
  - The minimum of one use of SHA3 in a unit test, to at least touch it at
    some point.
  - Documented the support of SHA3.
  - Only install the third-party library required by Python 3.5 when we're
    running on Python 3.5. Newer Python versions support SHA3 natively.

Shouldn't try to coerce bytes to a string. Instead, print the repr
value (e.g. b'mybytestring').

When running tests with the Python `-b` option, fixes warnings of the
form:

.../python-rsa/tests/test_strings.py:34: BytesWarning: str() on a bytes instance
  print("\tMessage:   %s" % message)
.../python-rsa/tests/test_strings.py:37: BytesWarning: str() on a bytes instance
  print("\tEncrypted: %s" % encrypted)
.../python-rsa/tests/test_strings.py:40: BytesWarning: str() on a bytes instance
  print("\tDecrypted: %s" % decrypted)

Implementation of the Mask Generation Function `MGF1` used in the OAEP encoding step.
For more information, the MGF1 specification is at https://tools.ietf.org/html/rfc2437#section-10.2.1