tdf#159519 comphelper,package: do not store document without SHA256

The problem is that on Windows 7 the password-encrypted documents are
stored unencrypted, without any error message.

This is due to defensive programming in
OStorageHelper::CreatePackageEncryptionData(), which happily continues
if creating the SHA256 hash fails, which is the one required for storing
anything newer than ODF 1.1.

Also, the poorly named ZipPackage::GetEncryptionKey() should check for
consistency, the expectation is that either there's no encryption key
(empty sequence), or the expected one is in the sequence.

Creating the SHA256 uses the crypto::NSSInitializer component, which is
in xsec_xmlsec.dll, which is linked to libxmlsec-mscng.dll, which is
linked to Win32 bcrypt.dll, which doesn't have BCryptKeyDerivation on
Windows 7; to reproduce elsewhere, rm instdir/program/libxsec_xmlsec.so

(regression from commit 26bf26272b
 and (due to revert) commit bfd479abf0)

Change-Id: I0b22e20f6d4d0b1a12ed7d99fac7b5243910f9ba
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/163708
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>

comphelper/source/misc/storagehelper.cxx

@@ -390,6 +390,7 @@ uno::Sequence< beans::NamedValue > OStorageHelper::CreatePackageEncryptionData(
         catch ( uno::Exception& )
         {
             TOOLS_WARN_EXCEPTION("comphelper", "Can not create SHA256 digest!" );
+            throw; // tdf#159519 DO NOT RETURN SUCCESS
         }
 
         // MS_1252 encoding was used for SO60 document format password encoding,

package/source/zippackage/ZipPackage.cxx

@@ -1728,6 +1728,11 @@ uno::Sequence< sal_Int8 > ZipPackage::GetEncryptionKey()
         for (const auto& rKey : m_aStorageEncryptionKeys)
             if ( rKey.Name == aNameToFind )
                 rKey.Value >>= aResult;
+
+        if (!aResult.hasElements() && m_aStorageEncryptionKeys.hasElements())
+        {   // tdf#159519 sanity check
+            throw uno::RuntimeException(THROW_WHERE "Expected key is missing!");
+        }
     }
     else
         aResult = m_aEncryptionKey;

sc/CppunitTest_sc_filters_test.mk

@@ -118,6 +118,7 @@ $(eval $(call gb_CppunitTest_use_components,sc_filters_test,\
     uui/util/uui \
     vcl/vcl.common \
     xmloff/util/xo \
+    xmlsecurity/util/xsec_xmlsec \
 ))
 
 $(eval $(call gb_CppunitTest_use_configuration,sc_filters_test))