Separate K-PKE scheme in ML-KEM

[marsella]

Right now the ML-KEM scheme has all of its functions inline. The K-PKE scheme is a sub-scheme that's used to implement ML-KEM, but cannot be used on its own. It would be good to separate these functions into their own submodule so that they are more obviously self contained, not the ML-KEM scheme, and not available for use outside of the module.

While we're moving around all the K-PKE stuff, we should also make a point to bring it up to our gold standard. Some suggestions are here, but this list isn't necessarily exhaustive.

• Make a K-PKE submodule in the ML-KEM specification. Remove the K_PKE_ prefix on the functions and update the calls to use the module path (K_PKE::KeyGen) instead.
• Write top-level docs for submodule explaining the limitations (doesn't do any input validation) and with loud warnings against using this outside the ML-KEM context.
  • Also make sure function-level docs have all appropriate warnings.
• Update the code to more obviously match the spec (there's not that much to do, I think)
  • Move the XOF call into SampleNTT
  • Consider making an EncryptionKey and DecryptionKey type to use in type sigs
  • Add inline docs to label the steps of each algorithm