WIP: bls12381 hash_to_g2 implementation

[wwared]

Still heavily WIP. Logic based mostly from circom-pairing's bls12_381_hash_to_G2.circom with help from bls12_381's map_g2.rs.

What's working so far (with tests):

• psi() and psi2()
• clear_cofactor()
• assert_subgroup_check() for G2
• scalar_mul_by_seed_square() for G1
• iso3_map()
• sgn0()
• opt_simple_swu2()
• map_to_g2()

To finish:

• assert_is_on_curve() for both G1 and G2
• phi() and assert_subgroup_check() for G1
• General cleanup and quick documentation pass

I created an add_or_double() function because the regular add() assumes that p != q (I will add a docstring documenting this properly). This is roughly equivalent to circom-pairing's EllipticCurveAdd, but doing what gnark's AddUnified does instead should be more efficient. This might be left for a future constraint-optimization PR though.

[wwared]

Superseded by #35