Make chk_encrypt correct with respect to non-block-aligned reads

Tahoe does not guarantee that segment boundaries will fall on AES128 block
boundaries.  After the first segment there's a very high chance reads will no
longer be block-aligned.

The `ctr` function used here produces correct results for a read of a partial
AES128 block but then forever after produces incorrect results.

Therefore, always read a full block if it is available.  A partial block can
still be read but only as the very last block ever.