[wip] belt-dwp

[makavity]

Hey! Need some help with belt-dwp implementation. According to article https://eprint.iacr.org/2020/331.pdf, I can use belt-ctr, instead of belt-block. But as I see, it is not compatible with current implementation. Here is the algorithm. @tarcieri @newpavlov https://rustcrypto.zulipchat.com/#narrow/stream/260038-AEADs/topic/belt-dwp/near/416835616