Implement Keccak-F, the Keccak sponge and SHA-3

[gilles-peskine-arm]

• Implement Keccak-F.
• Implement the Keccak sponge.
• Implement a low-level interface for SHA-3 (mbedtls_sha3_xxx), with both one-shot and multipart support.
• Write SHA-3 unit tests. The lower-level functions are not exposed in the API and are therefore only tested via SHA-3.

This is already done in #1549 but it require a major rebase.

Prerequisites: none.

Foreseen extensions:

• SHA-3 integration in the md module: Support SHA-3 through mbedtls_md #3752
• SHA-3 integration in PSA: Support SHA-3 through PSA #3753
• SHAKE: Implement SHAKE #3754
• cSHAKE: Implement cSHAKE #3755
• KMAC: Implement KMAC #3756
• Other Keccak-based primitives, such as tree hashing, Kravatte, etc.

• Make sure that we don't introduce the vulnerability from the reference implementation (see https://eprint.iacr.org/2023/331.pdf)

[mpg]

Note: it looks to me like this might have been resolved by merging #7708, but I'm not familiar enough with SHA-3 to judge for myself at a glance if 7708 did everything mentioned here or if there are some items left todo here.

So, I'm not closing the issue, and leaving the decision to people more familiar with this - perhaps @gilles-peskine-arm or @daverodgman

[gilles-peskine-arm]

Completed in #7708.