Make core subroutines that touch sensitive key material or data constant-time

[yspolyakov]

The goal is to provide protection against side channel attacks. For server-side operations, we can still use (faster) core subroutines with varying-time execution. An initial version of the implementation is discussed at #1177.

[BAder82t]

Hi @yspolyakov , opened #1211 which follows the approach suggested here. CT variants are added alongside the originals and only used in the decrypt path that touches secret key material. Server-side operations are unchanged