fix(hmac): enforce key length

[AndyVale]

The specs specify 32-byte keys for the HMAC. However, the code was only checking for non-empty keys, effectively accepting keys with a minimum length of 1 byte.

In normal conditions, a user would use a reasonably strong key, but since the check is trivial to add, I think it is worth explicitly validating the length of the provided key.

Without this check, an attacker who is somehow able to determine the length of the key could also brute-force it, completely compromising the system.

With this modification, the minimum key length is 32 bytes, as the other files suggest.

I also added a very simple unit test to check the error.