Add the three transforms for sha256(sha256(64_bytes))

Transforms 1 & 2 compute the inner `sha256(64_bytes)`:

- Transform 1: 64 bytes already fill the first block (no
padding needed), so we apply 64 rounds of compression
normally.
After T1: state = state + initial_state

- Transform 2: the message schedule at this step is constant
and known in advance (64 bytes of padding), so
we precompute W[i]+K[i] into MIDS and apply 64 rounds (no
schedule expansion needed).
After T2: state = state + saved_T1_state
(state now contains sha256(64_bytes))

- Transform 3 computes sha256(output_of_T1_and_T2). The output
is 32 bytes, so the block contains 32 bytes and the rest is
known padding. we precompute the message
schedule for the known words (w8-w15) into FINS.
After T3: state = state + initial_state
(state now contains the sha256d result)

test block counts 0 through 32
this allows our test to go through all SIMD distpatch paths we have:

- 1 block: software path
- 2 blocks: 2-way
- 3 blocks: 2-way + last block software
- 4 blocks: 2-way for now, (4-way once we add it)
- 8 blocks: 2-way for now (8-way once we add it)
- ... and so on up to 32