Bring NTT sections of ML-KEM up to gold standard

[marsella]

Right now there is a bunch of stuff related to NTT (Section 4.3) in the main body of ML-KEM. There are naive and fast versions of the NTT algorithm (with a "dispatcher" to hard-code which one to use), as well as 1D and 2D applications. We should try to contain this a little more intentionally.

There are also some places where the NTT-related code doesn't obviously align with the spec.

• Make an NTT submodule that contains all the NTT stuff -- everything in section 4.3. Maybe also section 4.3.1 -- I'm not sure what will make the most sense.
• Add types for Rq and Tq instead of using the same Z_q_256 for both. I'm not sure if this should belong in the NTT submodule or the enclosing one.
• At the "dispatcher", add docs explaining the equivalence of the two versions and note the specific place in the spec that says it's fine to use equivalent algorithms.
• We need to be able to run NTT over vectors and NTTInv over single elements and vectors. Rename NTT' and NTT to NTT and NTT_Vec, and similarly for NTTInv (related: Bring encoding and compression functions in ML-KEM up to gold standard #144 discusses the naming choice)
• In the submodule, make all the different instantiations of NTT private. The only public things in the submodule should be NTT, NTT_Vec, NTTInv, NTTInv_Vec, and, if they're included, MultiplyNTTs and the R_q/T_q types.
• Update the naive version (ParametericNTT) to more obviously match the spec.
  • In the spec, BitRev7 is supposed to operate over 7-bit vectors but it currently operates over 8-bit vectors. Try to align this better with the spec.
  • The use of BitRev7 in ParametricNTT is different from what's in the spec. Fix it or add a comment explaining why they're equivalent.
• Make sure all the NTT equivalence properties have docstrings
• Align MultiplyNTTs better with the spec. E.g. the exponent for zeta is not the same as what's in the spec. Fix it or add a comment explaining why they're equivalent.