Lattice decomposition cleanup

[mratsim]

Endomorphism acceleration #44 requires decomposing a scalar.

This is done using lattice decomposition using Babai's rounding techniques.

• [ ] Integrate in the property-based tests (requires clear cofactor #46)
• [x] The lattices should be moved in a per-curve-family configuration file:
  • https://github.com/mratsim/constantine/blob/2613356281ed33626bd9cc8b2cbaf68ae11a0867/constantine/elliptic/ec_endomorphism_params.nim#L29-L42
  • https://github.com/mratsim/constantine/blob/2613356281ed33626bd9cc8b2cbaf68ae11a0867/constantine/elliptic/ec_endomorphism_params.nim#L83-L96
• [x] Instead of a separate "true"/"false" field, the BIgInt can use an extra bit as a sign flag (still using 2-complement), this is detailed in the paper
• [x] The encoding can use 1-bit per bit instead of 2 for {-1, 0, 1} as the column sign information is already encoded in the very first row, this will also speed up recoding
• [x] The lattice can be stored in tuples instead of arrays so that the BigInt have the minimal size possible to reduce the cost of BigInt multiplication
• [x] BLS has multiplication factors of 1 and/or 2 which can be optimized
• [ ] The lattice and Babai roundings coefficient can be precomputed from the curve parameter instead of being hardcoded
• [x] The sage script should be fixed: https://github.com/mratsim/constantine/blob/2613356281ed33626bd9cc8b2cbaf68ae11a0867/sage/lattice_decomposition_bn254_snarks_g1.sage#L132-L178
• [x] We should not used signed integer as they introduce overflow checks which might leak secret bits
• [x] Some buffers don't need to be zero-initialized
• [x] Use window method to further accelerate 2-dimensional decompositions (https://github.com/mratsim/constantine/issues/45)
• [ ] Used mixed coordinates in the multiplication loop via an intermediate simultaneous inversion (#75)

[mratsim]

Several tasks ticked in #71

[mratsim]

And most other ticked in #94.

No plan to follow up on the rest for now.