std.crypto: make ghash faster, esp. for small messages

[jedisct1]

Aggregated reduction requires 5 additional multiplications (to precompute the powers of H), in order to save 2 multiplications per batch.

So, only use large batches when it's actually interesting to do so.

For the last blocks, reuse the precomputations in order to perform a single reduction.

Also, even in .ReleaseSmall, allow 2-block aggregation. The speedup is worth it, and the code increase is reasonable.

And in .ReleaseFast, bump the upper batch size up to 16.

Leverage comptime by the way instead of duplicating code.

std/crypto/benchmark.zig on Apple M1:

Zig 0.10.0: 2769 MiB/s
    Before: 6014 MiB/s
     After: 7334 MiB/s