Document that EVP_aes_256_xts is single-shot

This is true in both OpenSSL and BoringSSL.

Change-Id: I8be4e5776a76316246de8b2130e2dbf1ccb58ec6
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/99989
Auto-Submit: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Rudolf Polzer <rpolzer@google.com>

include/openssl/cipher.h

diff --git a/include/openssl/cipher.h b/include/openssl/cipher.h
index 5f3c592..74738f8 100644
--- a/include/openssl/cipher.h
+++ b/include/openssl/cipher.h
@@ -48,6 +48,11 @@
 OPENSSL_EXPORT const EVP_CIPHER *EVP_aes_256_cbc(void);
 OPENSSL_EXPORT const EVP_CIPHER *EVP_aes_256_ctr(void);
 OPENSSL_EXPORT const EVP_CIPHER *EVP_aes_256_ofb(void);
+
+// EVP_aes_256_xts implements AES-256-XTS. Unlike other `EVP_CIPHER`s, this
+// object is single-shot. It does not support splitting a single operation (one
+// set of key, IV, and input) into multiple `EVP_EncryptUpdate_ex` or
+// `EVP_DecryptUpdate_ex` calls.
 OPENSSL_EXPORT const EVP_CIPHER *EVP_aes_256_xts(void);
 
 // EVP_enc_null returns a 'cipher' that passes plaintext through as