sha2: tweak riscv_zknh backend

[newpavlov]

By following the software backend code the changes remove (unreachable) panic branches from the compact variant and reduce total amount of generated binary code.

Resulting assembly (old vs new):

• SHA-256 compact: https://rust.godbolt.org/z/784781hhE vs https://rust.godbolt.org/z/W56jz49dx
• SHA-256 unrolled: https://rust.godbolt.org/z/5Gb6rTzqM vs TODO
• SHA-512 compact: https://rust.godbolt.org/z/4TPoG98j1 vs https://rust.godbolt.org/z/f1j5365EG
• SHA-512 unrolled: https://rust.godbolt.org/z/1sGrKjxE8 vs TODO