Add a shortcut to speed up concrete evaluation of pmod.

[brianhuffman]

Used with a modulus of degree d, the low d bits of the input can be copied directly to the output unchanged. This lets us skip the first d iterations of the main loop.

This change reduces the runtime of my 42,000-bit polynomial GCD function from just over 3 minutes to less than 2.

[robdockins]

The argument is basically that the first d iterations will never reduce? I think I buy that.

Is this an improvement we can also fold into the reference implementation?

[brianhuffman]

We might be able to fold that into the reference implementation, but it's a bit tricky to do in cryptol because the polynomial degree of the modulus is not known statically, so we wouldn't be able to use cryptol sequences for doing loop iterations. I have an implementation of a variant of pmod in cryptol that uses this trick, but in my variant I assume an implicit leading 1 bit on the modulus, so the degree is fixed to match the bit width.