Optimize and simplify poly1305()
Optimize and simplify poly1305()

Constant-time processing of the final full carry in Poly1305 can be
simplified based on the following two observations.

(1) h % (2^130 - 5) = (h + c * 5) % 2^130, where c = (h + 5) >> 130.
    Requires only two 130-bit additions, whereas the previous method
    needed three: adding carry to h, calculating h - (2^130 - 5), and
    the third addition (or bitwise-OR) for selecting between the two.

(2) Carry propagation can be combined with packing into 32-bit words.
    This essentially further reduces the number of additions to 1.

Performance impact is negligible, in practice, since the processing of
message blocks is not affected. However, the commit simplifies the code
considerably by replacing 18 lines of code with 6.

resilar/sqleet,resilar/sqleet