non-temporal aes-gcm engine

[kazuho]

This PR implements "non-temporal aes-gcm" engine, that uses non-temporal store instructions when emitting encrypted bytes.

ToDo:

• Add more tests (like unaligned output).
• Use 256-bit AESNI / CLMUL instructions when available (Zen 3).
• Suppress false positives found by ASAN. The engine works on 64-byte lines. If either edge of the supplied output buffer is not aligned to 64-byte, the engine reads the 64-byte line covering the edge, modifies the necessary bytes, then write back the entire line.
• Implement decrypt side. It's a bit slower than OpenSSL with GCC, bit faster with clang.

Builds on top of #385.

Older result: as of e0caecc, aes128gcm (16KB block) throughput, compared to openssl (ubuntu 20.04):

	gcc (nt on)	gcc (nt off1)	clang (nt on)	clang (nt off)
Core i5 9400	84.1%	95.8%	91.1%	92.2%
Ryzen 7 4750G	97.9%	101.8%	97.3%	101.2%

*: "nt off" indicates that non-temporal store instructions (_mm_stream_si256) were replaced by ordinary stores (_mm_store_si256).

[huitema]

Maybe split this PR in two? First, do the API changes in struct st_ptls_aead_context_t, including the changes in the bcrypt library, and then, add the support for fastls?

[kazuho]

Maybe split this PR in two? First, do the API changes in struct st_ptls_aead_context_t, including the changes in the bcrypt library, and then, add the support for fastls?

Right. I opened the PRs in the wrong order, but #385 is supposed to do that.