Currently, the Windows BCryptEncrypt function is called with padding enabled every time SymmetricEncryptorWindows::update is called. This means that if it adds padding and then is called again, there is padding stuck in the middle of the encrypted buffer that won't be removed upon decryption.

Instead, SymmetricEncryptorWindows should maintain its own buffer equal to one block width, and only flush it to BCryptEncrypt when it is full, with no padding. SymmetricEncryptorWindows::finalize will also be refactored to make one last call to BCryptEncrypt, to encrypt whatever is left in the buffer, with padding enabled.