In addition to the original patch:
- simplify cipher object. drop the allocation and double redirection,
drop redundant `encrypt` member, shorten/dedupe names, replace `algo`
with `is_gcm`.
- replace heap alloc with stack buffer for GCM in `ssh2_cipher_crypt()`.
- use the algo argument instead of the context copy.
(for speed and to match OpenSSL sibling code.)
- fix returned error value on GCM auth fail.
- increment IV on decrypt auth fail. Copilot suggestion. I cannot
confirm this, so erring on the side caution to avoid a potential IV
reuse.
- support mbedTLS builds without GCM built-in, via `MBEDTLS_GCM_C`.
- retrofit bounds check applied to OpenSSL backend earlier.
Follow-up to a2ed82d409#2401
- misc tidy-ups.
Original-patch-by: Adrian Moran
Closes#1764Closes#2505
d5ba5bc77b