PEM and SSH format enhancements

pem_common_plug.c: pem_decrypt() decrypts the entire ciphertext, then uses a padding check for early-reject. It could instead start by decrypting only the last block (using the previous block as IV), do the padding check, and only if padding looks good (yet insufficiently large - see below) proceed to decrypt the remainder of the ciphertext (all but the already-decrypted last block) and do checks on it. The speedup will be very small, though, because most time is spent on PBKDF2, so even decrypting ~1 KB of data is relatively fast.

As a separate related enhancement, if the padding check is good and the padding is large enough, we can skip further checks. This wouldn't provide much speedup (for large paddings, those extra checks were rarely reached anyway), however it would reduce the likelihood of false negatives (in case our extra checks are too strict). For example, we can do:

         if (check_pkcs_pad(out, length, block_size) < 0)
                 return -1;

+        if (out[length - 1] >= 7)
+                return 0;

(or 6 if we aren't too afraid of false positives)

The above comments also apply to the version of pem_decrypt in run/opencl/pem_kernel.c.

While at it, in pem_common_plug.c: pem_decrypt() we could also drop the initial memset (looks unnecessary?) and replace the many uses of cur_salt->ciphertext_length with length (already initialized to the same value at the beginning of the function).

We should also move pem_common_plug.c: pem_decrypt() to pem_fmt_plug.c since that function is no longer shared with the OpenCL format.

Summarizing the above, it could be best to start with implementing the simpler changes - which means all but the first paragraph above.

Start with pem_common_plug.c: pem_decrypt() and compare the related implementation in run/opencl/pem_kernel.c. Review the simpler changes in the summary first, including the padding handling, redundant initialization and length uses, then examine moving the shared function to pem_fmt_plug.c. Done means the simpler enhancements are implemented consistently without taking on the optional partial-decryption change.