Use Span-based CreateHMAC where possible

[vcsjones]

Since CreateHMAC accepts a span now, use it where applicable.

PR is much easier to review when ignoring white space differences.

[ghost]

Tagging subscribers to this area: @bartonjs, @vcsjones, @krwq, @jeffhandley
See info in area-owners.md if you want to be subscribed.

[vcsjones]

@bartonjs I totally spaced on the downlevel targets. I put some #ifs there to get things moving along, but, if you think the impact on code readability isn't worth it, feel free to close the PR.

[stephentoub]

Nice.