This is a partial backport of core#19601
The unbackported part of the PR is currently only used by Bitcoin Core for Taproot related code, so I don't excpect we will need it. The backported method is needed in the MuHash3072 implementation.
The test vectors are from https://www.di-mgt.com.au/sha_testvectors.html