Add ML-DSA low-RAM optimization primitives

Add the optional HAVE_MLDSA_OPTIMIZATION building blocks: the 16-bit
NTT smallpoly for c*s products and the low-RAM helpers (compressed w,
compressed challenge, schoolbook c*t0/c*t1, fused A expansion, and hint
index lists) used by the constrained-target signing/verification path.