[MLS] Masking sender data

[Brendan McMillion <[e-mail]>]

Hello mls@

There's been an open ticket [1] on MLS for a while now to explore masking
sender data instead of encrypting it with an AEAD. I opened a PR [2] with
an initial attempt to achieve this, which I wanted to now introduce to the
list.

The first major change is to encrypt the first block of `ciphertext` under
a derived key with AES-ECB, and XOR the encoded SenderData with that value.
The masked sender data replaces the `encrypted_sender_data` and obsoletes
`sender_data_nonce`. The PR also specifies that the auth tag should be
truncated from the `ciphertext` because the full MLSCiphertext is now
authenticated with a MAC under a shared key, and this MAC is stored on its
own in an `auth_tag` field on MLSCiphertext.

The process of masking the sender data is designed to match the
construction HN1 in [3]. The reason for messing around with the MAC
structure, is that it allows us to validate the integrity of the sender
data before we use it to generate sender-specific keys, while still only
have one MAC total.

One of the downsides to this proposal is that it requires two passes over
the ciphertext, since we'd now encrypt and authenticate in separate passes.
While I'd like to get rid of this, I don't think it will be a big
performance issue for implementations.

Feedback welcomed!

1. https://github.com/mlswg/mls-protocol/issues/302
2. https://github.com/mlswg/mls-protocol/pull/360
3. https://eprint.iacr.org/2019/624.pdf