Add usedforsecurity to md5 constructor

[samuelraudabaugh]

This is required for using whoosh on a FIPS-compliant system. See http://blog.serindu.com/2019/11/12/django-in-fips-mode/ for context.