cmac: make subkey gen more constant-time
cmac: make subkey gen more constant-time

The previous version had secret-dependent memory accesses. While it was
probably not an issue in practice cause the two bytes of the array are
probably on the same cache line anyway, as a matter of principle this should
be avoided.

Mbed-TLS/mbedtls,ARMmbed/mbedtls,ARMmbed/mbedtls,NXPmicro/mbedtls,Mbed-TLS/mbedtls,ARMmbed/mbedtls,Mbed-TLS/mbedtls,Mbed-TLS/mbedtls,NXPmicro/mbedtls,NXPmicro/mbedtls,ARMmbed/mbedtls,NXPmicro/mbedtls