improve AES chaffing (power sidechannel hardening)

See https://github.com/betrusted-io/xous-core/pull/747

Chaffing currently is implemented using a simple first-order method where real/fake are swapped. A solution that uses a vector of 28 1's and 0's (of which 14 are guaranteed to be 1, 14 are guaranteed to be 0 but the ordering is random) to determine the computation order would probably greatly improve side channel resistance, but it would require extra bookkeeping and the routine is already tight on registers.

I'd say this is...currently a nice-to-have, but it would also be nice if anyone who has experience with sidechannel attacks could analyze how strong the chaffing is currently so we can adjust the priority of the fix.

The good news is that the only upatchable piece of code - boot0 - does not rely on AES, just curve25519, so we can upgrade this later on if side channels are found to be a significant issue.

So the "help wanted" part is anyone who has experience in power side channels and wants to give a go at characterizing the chaffing, let me know. I'd love to hook you up with what you need to make the experiment happen.