getAsInputStream throws MantaIOException when closing ~1% of the time

[tjcelaya]

When using client-side encryption with MantaClient.getAsInputStream() there are some situations where an exception is thrown with the message Expecting the end of the stream. However, more bytes were available. Pasted below is the exception, notice how plaintextContentLength and plaintextBytesRead match, so the error is probably occuring while reading the HMAC:

com.joyent.manta.exception.MantaIOException: Expecting the end of the stream. However, more bytes were available.
Exception Context:
	[1:path=/tomas.celaya/stor/theFile.tiff]
	[2:etag=477d0660-9c96-c810-8bea-ef26544ccb39]
	[3:lastModified=Mon Jun 12 09:28:23 KST 2017]
	[4:ciphertextContentLength=15435]
	[5:plaintextContentLength=15419]
	[6:plaintextBytesRead=15419]
	[7:cipherId=AES256/CTR/NoPadding]
	[8:cipherDetails=com.joyent.manta.client.crypto.AesCtrCipherDetails@4205bb1e[hmacAlgorithm=HmacMD5,authenticationTagOrHmacLength=16,keyLengthBits=256,cipherId=AES256/CTR/NoPadding,cipherAlgorithmJavaName=AES/CTR/NoPadding,isAEADCipher=false]]
	[9:cipherInputStream=org.bouncycastle.jcajce.io.CipherInputStream@1ed20d6d]
	[10:authenticationEnabled=true]
	[11:threadName=co.tjcelaya.sandbox.App.main()]
	[12:iv=4abdd5dd9c3355a966c6a13dd7b7f977]
	[13:hmacAlgorithm=MD5/HMAC]
---------------------------------
	at com.joyent.manta.client.crypto.MantaEncryptedObjectInputStream.close(MantaEncryptedObjectInputStream.java:678)
	at co.tjcelaya.sandbox.App.writeToFile(App.java:92)
	at co.tjcelaya.sandbox.App.main(App.java:65)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at org.codehaus.mojo.exec.ExecJavaMojo$1.run(ExecJavaMojo.java:282)
	at java.lang.Thread.run(Thread.java:748)

Reproduced reliably (though it takes at least 100 attempts for some runs) and PR coming soon.

[tjcelaya]

There seems to be an issue with the partial reads when using AES/CBC/PKCS5Padding and having libnss installed. Disabling libnss fixes the error so this will require further investigation.

Documented in #257