sha2: tweak riscv_zknh backend

[newpavlov]

By following the software backend code the changes remove (unreachable) panic branches from the compact variants and reduce total amount of generated binary code.

Resulting assembly (old vs new):

• SHA-256 compact: https://rust.godbolt.org/z/784781hhE vs https://rust.godbolt.org/z/Ys95fvMWq
• SHA-256 unrolled: https://rust.godbolt.org/z/5Gb6rTzqM vs TODO
• SHA-512 compact: https://rust.godbolt.org/z/4TPoG98j1 vs https://rust.godbolt.org/z/K3cnd1ece
• SHA-512 unrolled: https://rust.godbolt.org/z/1sGrKjxE8 vs TODO

[newpavlov]

Annoyingly, LLVM seems to be unable to remove unnecessary memset in message schedule: https://rust.godbolt.org/z/q9xbzKhcb (same with opt-level=2)