(gcm_gf_mul): Rewrote. Still uses the bitwise algorithm from the

specification, but with separate byte and bit loops. Improves gmac
performance a bit further, to 227 cycles/byte.

Rev: nettle/gcm.c:1.3