Refactor authenticated DHKEM paths to eliminate intermediate heap allocation

[danieldia-dev]

The authenticated KEM paths (auth_encap, auth_decap, and the test-only auth_encap_with_ikm) previously concatenated their two DH outputs into an intermediate Vec before passing them to extract_and_expand, which internally calls labeled_extract, which calls F::extract, which itself feeds the bytes into HkdfExtract::input_ikm sequentially. Note that this was only necessary because extract_and_expand took a single &[u8].

This PR adds a sibling function extract_and_expand_pieces that accepts multiple DH slices directly, mirroring the existing pattern already used on kem_context, and accordingly updates all three auth paths to use it. It also adds auth_encap and auth_decap benchmarks for X25519, which were previously missing from the benchmark suite.

Benchmarking the codebase before and after the change shows no statistically significant difference in auth_encap or auth_decap latency, since both changes fall within measurement noise (note that the observed seal/open regressions are on paths that were not affected by the refactor).

This is expected: modern allocators handle small short-lived allocations cheaply, and the two DH scalar multiplications that dominate the auth path cost largely outweigh any allocator overhead. As such, the change is a code quality improvement rather than a performance improvement.

Find attached a .txt file containing the benchmarking results:
benchmark.txt