Concentration for matrix products, and convergence of Oja's algorithm for streaming PCA