Precompute the PK.seed SHA-256 state in SLH-DSA-SHA2

In the SHA2 instantiation of SLH-DSA (FIPS 205, section 11.2), every
call to F, H, T_l, T_k and PRF starts by hashing
PK.seed || toByte(0, 64 - n). That is exactly one SHA-256 block, and it
is the same for every call made with a given key. The SPHINCS+ round
3.1 specification (section 8.1.6) pads PK.seed to a full block for this
reason, so that implementations can compute the state after that block
once instead of on every call.

Compute that state once per key generation, signing or verification
operation and keep it, with PK.seed, in a new slhdsa_hash_ctx. The
context replaces the raw PK.seed argument of the internal WOTS+, FORS,
XMSS and thash functions.

After the cached block, the rest of an F, H or PRF input (ADRSc and one
or two n-byte values) fits in a single block together with the SHA-256
padding. Build that block directly and process it with one call to
BCM_sha256_transform_blocks, rather than going through SHA256_Update
and SHA256_Final. For PRF calls the block contains SK.seed, and for F
calls it can contain secret WOTS+ or FORS values, so clear it with
OPENSSL_cleanse afterwards. Previously, SHA256_Final cleared the
equivalent buffer. T_l and T_k still use SHA256_Update and
SHA256_Final, starting from the precomputed state.

The output is unchanged, and so are the self-test known-answer values.
The fast path does not call SHA256_Final, so it does not update the
FIPS service indicator. Every SLH-DSA operation still calls
SHA256_Final at least once (for T_l, and for H_msg when signing or
verifying), so the indicator still moves during each operation, as it
did before. SLH-DSA-SHAKE-256f is not affected.

SLH-DSA-SHA2-128s on an Intel Xeon at 2.0 GHz without SHA-NI, median
of 15 runs:

           Before      After       Speedup
  keygen    158.3 ms    74.7 ms    2.12x
  sign     1204.6 ms   568.1 ms    2.12x
  verify    1.176 ms   0.565 ms    2.08x

Change-Id: Ib57a2fd38a113d65f2e0b3bbf03b884b616941ae
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/104029
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>