All of the backend infrastructure was in place to support &[u8],
and some functions already take `impl AsRef<[u8]>`. However the
main decode() and decode_header() functions require a &str. This
change updates a few internal signatures and adds a _bytes()
version of decode and decode_header.

When you're doing many requests per second, the cost of doing
an extra utf-8 check over header payloads is significant. By
supporting a &[u8] decode, users can let base64 and the crypto
implementation in question handle its own bytewise validity. They
already do this today in addition to the extra utf-8 scan.