chacha20-poly1305: add a fused AVX-512 ChaCha20-Poly1305 - #33215

• Interleave ChaCha20 and Poly1305 in one AVX-512 loop. ChaCha20 uses the vector integer pipes and Poly1305 uses IFMA, so the MAC overlaps the next chunk of keystream instead of a second pass.
• The provider uses this path for every non-TLS message when the CPU can run it. A TLS record uses the one-shot kernel, with the tag left in the RFC 7905 layout.
• The one-time Poly1305 key is wiped after use. A payload that would wrap the 32-bit block counter is rejected before any keystream is used.
• Tests compare the kernel, one-shot EVP, and TLS records with the two-pass oracle, including the park and MAC cutoffs and a non-zero TLS sequence number.

Measured with openssl speed -evp chacha20-poly1305 on an EPYC 9655, fused against the same binary with AVX-512 IFMA cleared. Encrypt is about 1.9x at 16 bytes, 2.8x at 64 bytes, 2.1x at 256 and 512 bytes, and 1.5x to 1.9x from 1024 bytes up. Decrypt is about 2.0x at 16 bytes, 2.8x at 64 bytes, 2.1x at 256 and 512 bytes, and 1.7x to 1.9x from 1024 bytes up. Median of three interleaved runs, pinned to one core.

System: AMD EPYC 9655 (Turin) 96-Core (Zen 5), 2 sockets, AVX-512 IFMA, RHEL 9, GCC 11.5.0 (-march=native) Command: openssl speed -evp chacha20-poly1305 [-decrypt] [-bytes N] -seconds 3 Method: single core pinned (taskset -c 0), median of 3 interleaved runs. Baseline = master. Numbers are MB/s (bytes/s / 1_000_000).

Encrypt

Baseline (master):

type                  16 bytes      64 bytes     256 bytes    1024 bytes    8192 bytes   16384 bytes
ChaCha20-Poly1305       337.51        513.79       1864.59       5277.15       5549.32       5570.79

chachapoly_avx512_fused:

type                  16 bytes      64 bytes     256 bytes    1024 bytes    8192 bytes   16384 bytes
ChaCha20-Poly1305       728.39       1407.80       3509.22       6477.76       7224.66       7478.34

Speedup over baseline:

                           16B           64B          256B         1024B         8192B        16384B
ChaCha20-Poly1305        2.16x         2.74x         1.88x         1.23x         1.30x         1.34x

Decrypt (-decrypt)

Baseline (master):

type                  16 bytes      64 bytes     256 bytes    1024 bytes    8192 bytes   16384 bytes
ChaCha20-Poly1305       363.20        511.40       1864.44       5254.21       5502.00       5551.80

chachapoly_avx512_fused:

type                  16 bytes      64 bytes     256 bytes    1024 bytes    8192 bytes   16384 bytes
ChaCha20-Poly1305       715.04       1459.05       3500.18       6791.19       7610.92       7667.72

Speedup over baseline:

                           16B           64B          256B         1024B         8192B        16384B
ChaCha20-Poly1305        1.97x         2.85x         1.88x         1.29x         1.38x         1.38x

Checklist

• documentation is added or updated
• tests are added or updated