mbedtls_gcm_init_soft() function

mbedtls_gcm_context::buf contains the partial state of the computation of the authentication tag. mbedtls_gcm_context::add_len and mbedtls_gcm_context::len indicate different stages of the computation: * len == 0 && add_len == 0: initial state * len == 0 && add_len % 16 != 0: the first `add_len % 16` bytes have a partial block of AD that has been xored in but not yet multiplied in. * len == 0 && add_len % 16 == 0: the authentication tag is correct if the data ends now. * len % 16 != 0: the first `len % 16` bytes have a partial block of ciphertext that has been xored in but not yet multiplied in. * len > 0 && len % 16 == 0: the authentication tag is correct if the data ends now.