Add a comment about ct and gcc builtins

On unoptimized gcc builds, __builtin_addcl isn't constant time. Add a
comment to that effect to warn people not to use unoptimized gcc builds.

Bug: 433162436
Change-Id: I01932341dcd382581d330fc0829340c6da6641c2
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/80547
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>

crypto/internal.h

diff --git a/crypto/internal.h b/crypto/internal.h
index 429f360..e1dcf223 100644
--- a/crypto/internal.h
+++ b/crypto/internal.h
@@ -1458,6 +1458,9 @@
 
 // CRYPTO_addc_* returns |x + y + carry|, and sets |*out_carry| to the carry
 // bit. |carry| must be zero or one.
+
+// NOTE: Unoptimized GCC builds may compile these builtins to non-constant-time
+// code. For correct constant-time behavior, ensure builds are optimized.
 #if OPENSSL_HAS_BUILTIN(__builtin_addc)
 
 inline unsigned int CRYPTO_addc_impl(unsigned int x, unsigned int y,