Rework cprng(9) man page to reflect the current state of affairs.

- Remove defunct cprng_strong_getflags/setflags.
- Remove defunct cprng_strong_ready.
- Document CPRNG_HARD.
- Omit cprng_strong structure, which is now opaque.
- Specify what can sleep and under what conditions.
- Be a little more consistent about some markup.

This is not the whole story (select/kqueue stuff for /dev/random is
still omitted), and I plan to change it some more (to split
cprng_strong into one routine that unconditionally guarantees as many
bytes as you asked, and another routine that may block or return
partial reads), but this will do until I find the time for those.

(riastradh)