ML-KEM libcrypto implementation polish

ML-KEM libcrypto implementation polish

* Core ML_KEM constants in new <openssl/ml_kem.h>

* Renamed variant ordinals to ML_KEM_<bits>_VARIANT, freeing
  up the unadorned ML_KEM_<bits> names.

* Fewer/cleaner macros in <crypto/ml_kem.h>

* Fewer/cleaner macros for setting up the ML_KEM_VINFO table.

* Made (d, z) be separate inputs to the now single key generation
  function.  Both or neither have to be NULL.  This supports potential
  future callers that store them in a different order, or in separate
  buffers.

    - Random values are chosen when both are NULL, we never return the
      generated seeds, rather we may, when/if (d, z) private key support
      is added, store these in the expanded key, and make them available
      for import/export.

* No need for a stand-by keygen encoded public key buffer when the
  caller does not provide one (will ask for it later if needed).
  New `hash_h_pubkey` function can compute the public hash from
  the expanded form in constant space (384 bytes for 12-bit encoded
  scalar).

* Simplified code in `scalar_mult`.

* New `scalar_mult_add` adds the product to an existing scalar.
  Used in new `matrix_mult_transpose_add` replacing `matrix_mult_transpose`.

* Unrolled loop in `encode_12`.

* Folded decompression and inverse NTT into vecode_decode, the three
  were always used together.

* Folded inverse NTT into former `matrix_mult` as `matrix_mult_intt`,
  always used together.

* New gencbd_vector_ntt combines CBD vector generation with inverse NTT
  in one pass.

* All this makes for more readable code in `decrypt_cpa` and especially
  `genkey()`, which no longer requires caller-allocated variant-specific
  temporary storage (just a single EVP_MD_CTX is still needed).

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26236)