Clean up small issues with AES

[marsella]

I was reviewing AES for a separate project and identified a few things I'd like to change to bring it closer in line with the spec, with respect to our gold standard criteria. Most of these are picky style preferences; none of them affect the functionality -- just readability and obvious spec equivalence.

• Add sbox example from p14 as a property (with a docstring)
• Change sbox to be an actual function instead of an array index
• Move SBox into the Algorithm module
• Rename Algorithm module to Cipher to match the spec sections
• Make AddRoundKey an explicitly named function instead of an inline ^ and replace all uses
• AES functor: wrap text on the constraint (this is a formatting nit - aim for <80 col)
• Update key expansion functions to use the same naming as the spec.
• Update key expansion to return a single array. Modify call sites (cipher and invCipher) to decompose internally. Note: the AES_GCM_SIV implementation also uses the key expansion types so we can't get rid of them entirely right now; document any types that are only kept for compatibility with that impl.
• Try writing cipher using the iterate function and decide if it looks nicer
• Rewrite subword without a list comprehension