Add clean and auto-optimized AES-GCM variants

This commit adds `crypto/fipsmodule/modes/asm/slothy` containing various
clean and auto-optimized AArch64 implementations of AES-GCM.

The clean versions are algorithmically derived from and still very close to
the existing AArch64 AES-GCM implementations. However, they have been
de-interleaved for better readability and verifiability. The application
of micro-optimizations (e.g. scheduling, software pipelining) is instead
handled automatically by SLOTHY.

To test a clean or optimized version, use `test.sh` from the `slothy`
directory, after adjusting AWS_LC_BASE and BUILD_DIR accordingly.

To run SLOTHY to optimize a clean version, use `optimize.sh`, after
installing SLOTHY and putting `slothy-cli` in your PATH.

crypto/CMakeLists.txt

@@ -182,6 +182,10 @@ if(ARCH STREQUAL "aarch64")
     chacha/chacha-armv8.${ASM_EXT}
     test/trampoline-armv8.${ASM_EXT}
     cipher_extra/chacha20_poly1305_armv8.${ASM_EXT}
+
+    fipsmodule/modes/asm/aesv8-gcm-armv8-slothy-128.S
+    fipsmodule/modes/asm/aesv8-gcm-armv8-slothy-192.S
+    fipsmodule/modes/asm/aesv8-gcm-armv8-slothy-256.S
   )
 endif()