Add DNDK-GCM without key commitment

[script3r]

Summary

• add DNDK-GCM (Double Nonce Derive Key AES-GCM) with 24-byte nonces and no key commitment (KC_Choice=0)
• include the draft Appendix A2 test vector
• add a DNDK-GCM Criterion benchmark

Context

DNDK-GCM is specified in draft-gueron-cfrg-dndkgcm (IETF Internet-Draft). It derives a fresh AES-256-GCM key from a 32-byte root key and the first 15 bytes of a 24-byte nonce, then uses the remaining 12 bytes as the GCM IV.

Implementation Notes

• derive_key_and_iv implements Algorithm 1 with KC_Choice=0: pad nonce to 27 bytes, split head/tail, compute B0..B2, AES-256 under the root key, then XOR with X0 to form the derived key.
• AES-GCM runs with the derived key and 12-byte IV to produce ciphertext and tag.

Testing

• cargo test -p dndk-gcm