Size improvements in AES and GCM

[daverodgman]

Description

Size improvements, mostly in AES, but also in GCM, plus a few very small wins I spotted in cipher.c.

This very slightly benefits our reference configuration (44 bytes saved), but the main saving comes with enabling GCM (~300 bytes), and for users who are only using hardware-accelerated AES (2.1 kB).

In total, the best-case saving is ~2.7 kB.

Follow-on from #8716

PR checklist

Please tick as appropriate and edit the reasons (e.g.: "backport: not needed because this is a new feature")

• [x] changelog no functional change
• [x] backport no
• [x] tests added a few tests for padding generation as this didn't seem to be explicitly tested

Notes for the submitter

Please refer to the contributing guidelines, especially the checklist for PR contributors.

Help make review efficient:

• Multiple simple commits
  • please structure your PR into a series of small commits, each of which does one thing
• Avoid force-push
  • please do not force-push to update your PR - just add new commit(s)
• See our Guidelines for Contributors for more details about the review process.