Use lazy reduction and parallel ExpandMask in ML-DSA

matrix_mult_montgomery Montgomery-reduced every product and then added
it to the output with a conditional subtraction. The inputs are fully
reduced, so for each coefficient the sum of the L products is at most
7 * (8380417 - 1)^2, well within the range reduce_montgomery accepts.
Instead, sum the 64-bit products and reduce once per coefficient. A
static_assert checks the bound. This speeds up the matrix-vector product
in key generation, signing and verification.

vector_expand_mask sampled the L scalars of y one at a time, each a
separate SHAKE256 computation of about five Keccak permutations, on
every signing attempt. The scalars are independent, so sample them with
the parallel x4 and x2 Keccak implementations, as vector_expand_short
already does for s1 and s2. A shared helper sets up the SHAKE256 input,
so every variant absorbs the same bytes.

The output is unchanged, as are the self-test known-answer values, and
the code remains constant-time.

Median of 15 runs on an Intel Xeon (Skylake-SP) at 2.0 GHz, in
microseconds:

                  Before     After   Speedup
  ML-DSA-44
    keygen          73.1      71.2     1.03x
    sign           274.8     224.2     1.23x
    verify          58.7      56.9     1.03x
  ML-DSA-65
    keygen         125.1     120.7     1.04x
    sign           424.7     371.3     1.14x
    verify          93.1      89.0     1.05x
  ML-DSA-87
    keygen         187.6     176.7     1.06x
    sign           502.7     421.9     1.19x
    verify         149.2     139.6     1.07x

Change-Id: I9f50a41319acff3846af7021fc89670cddc83c65
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/104088
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>