Part 2: aes-lowmemory: constant-time, table-free bit-sliced AES

[dghgit]

Part 2 of 3, stacked on Part 1. Content is identical to #99 as reviewed and merged (commits 75789c9..f119c2a, by @officialfrancismendoza).

• New crate crypto/aes-lowmemory (bouncycastle-aes-lowmemory): AES-128/192/256 as a raw keyed permutation, bit-sliced over eight u32 planes with the 113-gate Boyar-Peralta S-box circuit -- no lookup tables, no secret-dependent branches or indexing, including in the key schedule.
• One unmodified key schedule serves both directions (FIPS 197 Algorithm 3); 176 / 208 / 240 B of state, pinned by test and by mem_usage_benches/bench_aes_mem_usage.
• Verified against FIPS 197 Appendix A (every schedule word) and B, an exhaustive S-box / inverse S-box check against Tables 4 and 6, SP 800-38A F.1, and 2138 NIST ACVP ACVP-AES-ECB cases from bc-test-data.
• Workspace, umbrella re-export, criterion benches, release note.

Deliberately ships no CLI, factory entry or cipher-trait impls: a bare permutation can only offer ECB. Those arrive with Part 3.

[ounsworth]

I am starting a review of this PR as part of the 6-PR stack.
David has asked that I review the entire stack, and then circle back to the beginning and clean up my comments before anyone else start reacting to them. So I'll comment again on this PR when I'm ready for my comments to be taken seriously. (I may keep my review in Draft mode so that only I can see it until I'm ready to release my comments for all PRs at the same time).

Note: a 3,500 line PR will take me a number of days to read and form a mental picture of.