The actual ciphertext of a streaming AEAD begins with a header (i.e. the header is a part of the ciphertext), so ciphertext_offset should obey this semantics. PiperOrigin-RevId: 256942210
