sha1-checked: implement hardware acceleration on arm64 and x86_64

[srijs]

re #909

Implements hardware acceleration for sha1-checked on both arm64 and x86_64 architectures.

This is largely based on the existing sha1 implementation, with modifications to spill W0..W79 into a buffer as the message is being expended. The way this then works is by running the happy path via the specialized hardware instructions, and falling back to the scalar implementation only if a potential collision is detected.

Also tried to match using cpufeatures and cfg-if as best as possible, yet slightly different as it's somewhat of a different surface here. Let me know where you'd like me to adjust this.

Code duplication between sha and sha1-checked is obviously one of the not so nice aspects here - if you have ideas or a desire to share the instrinsics code across the crates let me know!

---

Measured with the crate's own bench suite:

	before	after	speedup
aarch64 (dedicated Apple Silicon)	928 MB/s	1996 MB/s	2.15x
x86_64 (AMD EPYC, sha_ni, cloud sandbox)	~300 MB/s	~640 MB/s	~2.1x

For comparison, performance relative to plain sha1 on the same backend, i.e. what fraction of un-checked SHA-1's speed detection reaches:

	scalar	hardware-accelerated
aarch64	64%	63%
x86_64 (sha_ni)	~55%	~38%

Note: On aarch64, hardware acceleration speeds up sha1 and sha1-checked by about the same factor, so the relative gap to plain SHA-1 barely moves. On x86_64 it doesn't, instead the gap actually widens (but of course still improving the absolute performance).

[srijs]

This is existing code, moved over from compress.rs and with some pub(crate) exports added.

[srijs]

This is more or less the same as the sha1 implementation, with two key differences:

1. It's just a single block rather than a loop over blocks.
2. We spill the word sequence (W_0 .. W_79) into w as they are expanded across the rounds.

[srijs]

Same deal here, based on the original sha1 impl, cut down to a single block, and added word spilling.