Speed up AES-GCM on aarch64

[brian-pane]

The Graviola implementation of AES-GCM on aarch64 is slower than aws-lc-rs. These are typical of the benchmark results I see on Apple M4:

aes128-gcm/aws-lc-rs/2KB
                        time:   [251.61 ns 252.00 ns 252.37 ns]

aes128-gcm/graviola/2KB time:   [307.78 ns 308.49 ns 309.27 ns]

If it won't interfere with anyone else's work, I'd like to try making a PR to stitch the AES and Ghash operations, similar to the current x86_64 implementation.

[brian-pane]

One other thing I noticed while profiling with Samply is that about 10% of the total run time of aes128-gcm/graviola/2KB is spent toggling the processor's DIT state on and off. (That's based on elapsed time measurements, since I don't have a good profiling tool to measure CPU cycles on macOS.)