[core] Scalar clmul64 is wrong

[robinhundt]

The scalar fallback implementation of clmul64 is wrong. See celabshq/libcrux#1340 (comment) for context.

This might also explain some spurious failures on macos, as this is the only platform where this code is executed.

[robinhundt]

I think this could have been caught by using proptest to test the scalar against the SIMD implementation. Worth trying out.

[robinhundt]

Mhh, apparently proptest does not catch this issue...

    proptest! {
        #[test]
        fn test_clmul128(a in any::<u128>(), b in any::<u128>()) {
             unsafe {
                let clmul_res = clmul::clmul128(transmute(a), transmute(b));
                let scalar_res = scalar::clmul128(a, b);
                assert_eq!(scalar_res.0, transmute(clmul_res.0));
            }
        }
    }

succeeds in all runs I've tried so far. I assumed that proptest would always try some edge case values, but apparently this often requested feature has not been implemented :(