chacha20: Replace salsa20-core with ctr-derived buffering

[tarcieri]

The previously used buffering logic in the salsa20-core crate is complex, hard-to-audit, and slow:

https://github.com/RustCrypto/stream-ciphers/blob/6be62af/salsa20-core/src/lib.rs#L93

The main reason is because it tries to handle too many things at once, namely:

• serializing the ChaCha20 block function output as little endian bytes
• implementing the stream-cipher APIs

This commit gets rid of salsa20-core as a dependency (which is also making it difficult to do further SIMD optimizations), replacing it with code derived from the ctr crate, but specialized to the ChaCha20 use case. It also changes the Block::generate API to write into a referenced slice as output, handling little endian serialization (which for the SSE2 backend is a noop), allowing the buffering code to work in terms of bytes rather than u32 arrays.

This results in a ~40% performance improvement (bringing us from ~3.5cpb to ~2.4cpb):

chacha20/apply_keystream/1024
                        time:   [2504.7967 cycles 2524.0030 cycles 2547.6807 cycles]
                        thrpt:  [2.4880 cpb 2.4648 cpb 2.4461 cpb]
                 change:
                        time:   [-32.266% -30.047% -27.734%] (p = 0.00 < 0.05)
                        thrpt:  [+38.378% +42.952% +47.637%]
                        Performance has improved.

chacha20/apply_keystream/2048
                        time:   [4980.9154 cycles 5002.3081 cycles 5025.7369 cycles]
                        thrpt:  [2.4540 cpb 2.4425 cpb 2.4321 cpb]
                 change:
                        time:   [-38.110% -36.161% -33.880%] (p = 0.00 < 0.05)
                        thrpt:  [+51.239% +56.644% +61.576%]
                        Performance has improved.

chacha20/apply_keystream/4096
                        time:   [9873.7431 cycles 9912.0935 cycles 9957.6095 cycles]
                        thrpt:  [2.4311 cpb 2.4199 cpb 2.4106 cpb]
                 change:
                        time:   [-30.936% -29.335% -27.274%] (p = 0.00 < 0.05)
                        thrpt:  [+37.502% +41.513% +44.792%]
                        Performance has improved.

chacha20/apply_keystream/8192
                        time:   [19833.5433 cycles 19911.5519 cycles 20008.2953 cycles]
                        thrpt:  [2.4424 cpb 2.4306 cpb 2.4211 cpb]
                 change:
                        time:   [-30.941% -29.657% -27.959%] (p = 0.00 < 0.05)
                        thrpt:  [+38.809% +42.160% +44.803%]
                        Performance has improved.

chacha20/apply_keystream/16384
                        time:   [39444.3470 cycles 39654.3508 cycles 39920.3374 cycles]
                        thrpt:  [2.4365 cpb 2.4203 cpb 2.4075 cpb]
                 change:
                        time:   [-30.878% -29.276% -27.000%] (p = 0.00 < 0.05)
                        thrpt:  [+36.986% +41.395% +44.672%]
                        Performance has improved.