armv8crypto: Fix some edge cases in the AES-GCM implementation

[markj]

Summary

• We only hash up to the first 16 bytes of the AAD.
• When computing the digest during decryption, handle the case where len == trailer properly.

While here:

• trailer is always smaller than AES_BLOCK_LEN, so remove a pair of unnecessary modulus operations.
• Replace some byte-by-byte loops with memcpy() and memset() calls. In particular, zero the full block before copying a partial block into it since we do that elsewhere and it means that the memset() length is known at compile time.

Test Plan

Noticed when doing some refactoring, verified with cryptocheck.

Specifically, I used cryptocheck -d soft -a aes-gcm -z.