camellia: Replace S-Box lookup tables

[aumetra]

The camellia cipher currently uses lookup tables instead of a bitsliced/hardware accelerated backend.

I mention hardware acceleration because there are affine isomorphisms between the AES S-Box and the Camellia S-Box, meaning you can utilise AES-NI or AES bitslicing (and their SIMD accelerations) on Camellia through introducing a small affine transformation over GF(2).

See: https://arxiv.org/abs/2411.12360

---

I'm just noting this down here to get some input whether this kind of solution is something this project is interested in. I have started drafting out some things in code in a fork and would PR it as soon as it's in a ready enough state.

[aumetra]

(as you can see from the paper, this is technically also a generalisable technique to ARIA, which is also using S-Boxes in-tree)

[aumetra]

In preliminary tests using this technique and using vector instructions for the affine transformations, the performance vs the s-box indexing version is roughly 1:3, so a roughly 66.6% performance regression.

Not good but potentially optimisable but it will probably not match the performance of the naive implementation.

[newpavlov]

This looks like a good potential change. We already make performance tradeoff with aes (see #548), so it makes sense to make it for other crates as well if have a proper bitsliced implementation. Although it's probably worth to keep the lookup-based implementation gated behind a configuration flag instead of just removing it.