Taken from BearSSL again, because the implementation seems sensible.
Unlike AES, I probably only will do the `ghash_ctmul64.c` code, since
the benchmarks on the site indicate that running the 64 bit code on
32 bit systems isn't a devastating performance hit.

And really, the 90s called, they want their processors back.