Faster Shuffle

For R1s, shuffle values by sorting instead of the obvious Fisher-Yates
algorithm. Fisher-Yates is simple to implement and correct, but not easily
parallelizable. For a sufficiently parallel architecture, it is faster to sort
many times, than Fisher-Yates shuffle once.

Shuffle values by assigning each value a random key and sorting the keys. Keys
can collide causing detectable patterns in the shuffled output. Collisions
translates into more ascending sub-sequences in the shuffled output than would
be expected by chance. To avoid collisions, the number of possible key values
must be sufficiently large.

How are more than 2^32 keys created? In each loop iteration, the algorithm sorts
by random keys. Conceptually, the earlier iterations are sorting on the
lower-order bits of larger keys that are never actually assembled.

The expected number of collisions is n - d + d(1 - 1/d)^n, where d is the number
of possible keys and n is the number of values. If d = n^2, then the limit as n
goes to infinity is 1/2. If d = n^3, then the limit as n goes to infinity is
zero.

This implementation ensures that the key-space is greater than or equal to the
cube of the number of values. The risk of collisions can be further reduced by
increasing Exponent at the expense of performance.

For Exponent = 2, the expected number of collisions per shuffle is maximized at
n = floor((2^32-1)^(1/2)) = 65535 where the expectation is about 1/2.

For Exponent = 3, the expected number of collisions per shuffle is maximized at
n = floor((2^32-1)^(1/3)) = 1625 where the expectation is about 1/3255.

For Exponent = 4, the expected number of collisions per shuffle is maximized at
n = floor((2^32-1)^(1/4)) = 255 where the expectation is about 1/132622.
PiperOrigin-RevId: 203516708