verified-garbage: avoid extra copies in streaming ciphers and AEADs

Streaming cipher updates now encrypt directly into the result bytes, as
the OpenSSL path does, instead of into a zeroed scratch buffer that is
then copied: for 1 MiB inputs the two fresh allocations cost more than
the encryption (AES-CTR went from 1.0 to over 7 GB/s). AES-GCM and
ChaCha20-Poly1305 use verified-garbage's out-of-place encryption,
saving a copy of the plaintext.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nb78iYb3eVhNTd3P8ypV2X