Optimization, IDPF: only derive the extend and convert PRG fixed keys once

[divergentdave]

Following #510, we may want to introduce a new way to construct PrgFixedKeyAes128 that separates the fixed key derivation so we can only perform it once, and then reuse it across multiple IDPF levels, with different seeds each time. We'd need to add a new factory type, and use that instead of Prg::init() to construct a new PRG with each successive seed.

[divergentdave]

Poplar1 with the fixed key PRG is currently 7%-10% slower, which makes sense because we do the same amount of cSHAKE128 absorbing, cut the squeezing in about half, and add AES key derivation and encryption. We'll need to make this optimization to realize the performance benefits of fixed key AES.

[cjpatton]

Let's definitely do it before the next release?