Remember that when accessing raw javascript functions you need to make use of Clojure's interoperability features, just like you would on the JVM. This means your namespace declaration changes to this:
(ns tutorial-client.sha256
(:import goog.crypt.Sha256]))
(.log js/console (Sha256.))
;; this will log the instance to the browser console
From here on you should be able to use it normally, by calling the instance's javascript functions:
(def sha-256 (Sha256.))
(.update sha-256 [])
(.log js/console (.digest sha-256))