Neon impl of ChaCha20 (better size & perf)

[daverodgman]

Description

Neon implementation of ChaCha20 which, depending on how it's configured, is ~500b smaller than the scalar impl, or up to 4.6x faster. In its default setting it has slightly better code size than the scalar impl, and is 2-2.3x faster.

Tested on all combinations of Armv7 arm/thumb2; Armv8 arm/thumb2/aarch64 on clang 14, gcc 11, and some more recent versions, plus Armv8 aarch64_be on gcc 7.5.

PR checklist

Please remove the segment/s on either side of the | symbol as appropriate, and add any relevant link/s to the end of the line.
If the provided content is part of the present PR remove the # symbol.

• changelog provided | not required because:
• development PR provided # | not required because:
• framework PR provided Mbed-TLS/mbedtls-framework# | not required
• 3.6 PR not required because: non-functional change
• 2.28 PR not required because: non-functional change
• tests provided

	multiblock setting	size delta c.f. main	perf delta c.f. main
clang	0	-180	0%
	1	-624	14%
	2	-416	64%
	3	-216	98%
	4	12	172%
	5	288	161%
	6	520	224%
gcc	0	-128	0%
	1	-576	57%
	2	-332	129%
	3	-56	177%
	4	252	280%
	5	608	273%
	6	744	355%

[davidhorstmann-arm]

This framework change looks spurious