REALITY protocol: Add ChaCha20 mode

[H1JK]

This PR introduces a new mode of REALITY protocol, authentication part. And this is the server-side update of the new mode.

Details: Client will use CHACHA20-POLY1305 as AEAD cipher for session ID encryption when a non-AES-GCM cipher is listed at the first in the Client Hello cipher suites. This would fix constant-time and efficiency problem for Go AES implementation on unsupported platforms.

The existed aesgcmPreferred function is used. Client implementation may need use linkname to export this internal function. This needs further discussion.

Note that this may not break the old version protocol compatibility, because all preset parrots in uTLS are AES-GCM preferred (at present). See also refraction-networking/utls#190.

[RPRX]

感谢 PR，我想了一下，现有的 randomized 可能会出现 chacha 优先，可以解密两次，或者直接 break，反正本来就不推荐用它

[H1JK]

I tend not to make changes for old randomized compatibility, as this will have only a small impact and is not faced by most users.

Update: Client side update is there ready for PR https://github.com/H1JK/Xray-core/tree/reality-chacha20poly1305

[RPRX]

可以去给 Xray-core PR 啦

[toyo2333]

可以去给 Xray-core PR 啦

我代理闲置的情况下（没有客户端连接的时候）出现了这样的日志（一个印度ip），请教这是怎么回事？是我被攻击了么？

REALITY remoteAddr: 157.245.109.22:46568
REALITY remoteAddr: 157.245.109.22:46568        hs.c.AuthKey[:16]: [XXXX]    AEAD: *aes.gcmAsm
REALITY remoteAddr: 157.245.109.22:46568        hs.c.conn == conn: false
REALITY remoteAddr: 157.245.109.22:46578
REALITY remoteAddr: 157.245.109.22:46592
REALITY remoteAddr: 157.245.109.22:46596
REALITY remoteAddr: 157.245.109.22:46604
REALITY remoteAddr: 157.245.109.22:46604        handled: false
2023/08/18 21:24:03 [Info] transport/internet/tcp: REALITY: processed invalid connection
REALITY remoteAddr: 157.245.109.22:46614
REALITY remoteAddr: 157.245.109.22:46614        handled: false
2023/08/18 21:24:04 [Info] transport/internet/tcp: REALITY: processed invalid connection
REALITY remoteAddr: 157.245.109.22:46616
REALITY remoteAddr: 157.245.109.22:46616        handled: false
2023/08/18 21:24:04 [Info] transport/internet/tcp: REALITY: processed invalid connection
REALITY remoteAddr: 157.245.109.22:46624
REALITY remoteAddr: 157.245.109.22:46624        hs.c.AuthKey[:16]: [XXXXXX]      AEAD: *chacha20poly1305.chacha20poly1305
REALITY remoteAddr: 157.245.109.22:46624        hs.c.conn == conn: false
REALITY remoteAddr: 157.245.109.22:46638
REALITY remoteAddr: 157.245.109.22:46650
REALITY remoteAddr: 157.245.109.22:46658
REALITY remoteAddr: 157.245.109.22:46658        hs.c.AuthKey[:16]: [XXXXX]   AEAD: *chacha20poly1305.chacha20poly1305
REALITY remoteAddr: 157.245.109.22:46658        hs.c.conn == conn: false
REALITY remoteAddr: 157.245.109.22:46568        handled: false

那一长串数字对，我不知道是否敏感，用XXXX代替了。

背景：我是偷自己，自己的域名上也有一个服务在跑。XTLS/Xray-core#2456

[RPRX]

出于以下三个原因，现决定 revert 掉这个支持：

1. TLS client & server: Support Encrypted Client Hello (ECH) Xray-core#3813 (comment) 开始的相关讨论，盲猜实际用率不及万分之一
2. 所以“fix constant-time and efficiency problem for Go AES implementation on unsupported platforms”没有实际实现
3. 其实我一直想提出这会导致服务端的计算速度略有不同，虽然很小，且基本上会被“到 target 的延迟”给掩盖掉