Add benchmark.
Shorten benchmark and change order.
Optimized version.

We exploit XSalsa20 specifics to speed up encryption/decryption, while
keeping the format intact (that is, an unoptimized version can decrypt
and encrypt the same data as the optimized one).

XSalsa20 expands Salsa20 nonce from 8 bytes to 24 bytes by (1) first
deriving a subkey from a 32-byte key and first 16 bytes of 24-byte full
nonce, and then (2) using this derived subkey as a key for Salsa20 and
the last 8 bytes of full nonce as a nonce for it.

I deliberately designed the chunking format to put a 8 byte chunk
counter into the last part of XSalsa20 nonce: this way, we can derive a
subkey only once for all chunks like in (1), and then use the chunk
counter as a nonce for (2).

Basically, now instead of:

  for each chunk:
    subkey = hsalsa20(key, nonce)
    salsa20(subkey, chunkCounter)
    poly1305()
  end

we do:

  subkey = hsalsa20(key, nonce)
  for each chunk:
    salsa20(subkey, chunkCounter)
    poly1305()
  end

which are equivalent, but the optimized version avoids calling HSalsa20
for each chunk.