Make public fields final where possible

Make public fields final where possible

Class fields initialized via the constructor should be final.

Also mark leaking byte[] instances with a FIXME. API users consider them
immutable, but they are vulnerable to System.arrayCopy().

Also fixes constructor arguments so they do not use underscores, which
is prohibited by Java 9.

Change-Id: I393d55ed7234149cb3604bc92b2cb1d1207c55dc
Signed-off-by: Robert Varga <[email protected]>