Add SHA256TREE: a version of SHA-256 that supports chunking

In PR #233 I proposed the addition of two new ContentAddressableStorage
methods (ConcatenateBlobs and SplitBlobs) that allow one to gain random
access it large CAS objects, while still providing a way to very data
integrity. As part of that change, I added a new digest function to help
with that, named SHA256TREE.

This PR adds just this digest function, without bringing in any support
for chunking. This will be done separately, as it was requested that
both these features landed independently.

I have also included test vectors for the SHA256TREE digest function.
I have derived these by implementing three different versions in the Go
programming language:

- One version that uses regular arithmetic in Go.
- One version for x86-64 that uses AVX2.
- One version for ARM64 that uses the ARMv6 cryptography extensions.

All three versions behave identically.