ExtractUserKey() should be able to signal corruption

ExtractUserKey() has an assertion that its input size is at least 8 bytes, but the callers don't have checks corresponding to this assertion. This is fine under normal operation, but can lead to crashes when operating on corrupted files.

#103 documents such a crash. https://crbug.com/964851 explains how to create a corrupted file that will result in a crash.

We should audit all calls to ExtractUserKey() to see if the pre-condition is guaranteed to be met in non-obvious ways. If that's the case, we should document the reasoning. If not (my assumption), we should have ExtractUserKey() return a MaybeSlice (regular Slice plus invalid state), and bubble up ExtractUserKey() failures as corruption.