Allow hax extraction for ML-DSA

[jschneider-bensch]

This PR will make it possible to extract ML-DSA to F*.

• Cast match scrutinees to known-size types as a workaround for F*: pattern matching is disallowed on usizes, isizes (+u128/i128) hacspec/hax#464
• Replace loop/continue/break-style rejection sampling with a bounded loop. As @xvzcf had already pointed out, the probability of the bounded rejection sampling to not succeed within 576 attempts is smaller than 2^128. Nonetheless, I've introduced a SigningError type to indicate this, so we don't panic, even in this most unlikely case.
• RefMut issues in encoding::signature: Solved this by accessing signature[offset + ...] directly instead of using let hint_serialized = &mut signature[offset..].
• FunctionalizeLoops issue in encoding::signature: The error message was a bit opaque, in that the issue was early returns in this function. I've replaced them with some (rather inelegant, I'm afraid) flag and that's used to manually breaks out of the loops and signals an error should be returned at the end.
• Add minimalistic extraction to CI: This just runs cargo hax into fstar

[franziskuskiefer]

Thanks. Two nits, then we can get this in.

[franziskuskiefer]

Oh and I created a conflict with #524 that need to get resolved.

[jschneider-bensch]

After merging and resolving, more of the AVX2 implementation seems to be going through hax, probably because the multiplexing works 👍
To fix the extraction I had to update the intrinsics interfaces for hax and cast match scrutinees in more places.