aes-gcm: make AesGcm generic around nonce size

[tarcieri]

Support for non-96-bit nonces, while still implementing the current Aead interface and type safety for nonce lengths.

[codecov-io]

Codecov Report

Merging #126 into master will increase coverage by 0.71%.
The diff coverage is 92.18%.

@@ Coverage Diff @@## master #126 +/- ##
==========================================
+ Coverage 96.26% 96.98% +0.71% 
==========================================
Files 28 28 Lines 697 730 +33 ==========================================
+ Hits 671 708 +37 + Misses 26 22 -4 

Impacted Files	Coverage Δ
crypto_box/tests/lib.rs	95.34% <85.71%> (-4.66%)	⬇️
aes-gcm/src/lib.rs	90.00% <88.00%> (-4.88%)	⬇️
aes-gcm/src/ctr.rs	100.00% <100.00%> (ø)
aes-siv/tests/aead.rs	100.00% <100.00%> (ø)
chacha20poly1305/tests/lib.rs	100.00% <100.00%> (ø)
ring-aead/tests/common/mod.rs	100.00% <100.00%> (ø)
ring-aead/src/lib.rs	87.09% <0.00%> (+6.45%)	⬆️
chacha20poly1305/src/lib.rs	100.00% <0.00%> (+16.66%)	⬆️
crypto_box/src/lib.rs	100.00% <0.00%> (+18.51%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 5a28e70...0b0a23f. Read the comment docs.

[tarcieri]

The test vectors still pass for 96-bit nonces, however there aren't any for non-96-bit nonces, and I'm not convinced this is correct yet, namely this part:

It appears after inputting a zero-padded non-96-bit nonce into GHASH, it should also be followed by its length.

Regardless, we should add test vectors for non-96-bit nonces.

[tarcieri]

I added some tests for non-96-bit IVs based on the NIST CAVS vectors and they're presently failing, even after attempting to include the IV length in the GHASH message.

[tarcieri]

Ok, got it working after updating the CTR implementation to parse a base counter value from 𝐉₀