Optimize the Final exponentiation

[yelhousni]

#74
[WIP] [Ready to merge]

This PR, implements Karabina's compressed cyclotomic squaring and decompression. It also merges @gbotrel work on F_p inverse.

The trick of mixing the GS and Karabina cyclotomic squares in Expt() combined with the new inverse yields speedups in the final exponentiation for BLS12-377, BLS12-381 and BLS24-315 but not BW6-761 and BW6-633.

• BLS12-377: s=46 --> 14% speedup
• BLS12-381: s=32 --> 6% speedup
• BLS24-315: s=20 --> 12% speedup [edit] 14% speedup with Montgomery batch inverse

N.B. For BLS12-381, there another series of 15 0's but it's not worth doing it with Karabina. If we manage to make the inverse even faster (e.g. Pornin with assembly), then it might lead to some speedup with a Montgomery batch inverse.

[yelhousni]

[WIP] because AMD behaves differently than Intel with assembly.. We might go back to a pure Go inverse version or implement Pornin's inverse (in pure Go).

[yelhousni]

With asm-inverse removed (on AWS z1d.large):

[ec2-user@ip-172-31-25-164 ~]$ benchcmp old-fe-bls381.log new-fe-bls381.log
benchcmp is deprecated in favor of benchstat: https://pkg.go.dev/golang.org/x/perf/cmd/benchstat
benchmark                          old ns/op     new ns/op     delta
BenchmarkFinalExponentiation-2     362464        354933        -2.08%
[ec2-user@ip-172-31-25-164 ~]$ benchcmp old-fe-bls377.log new-fe-bls377.log
benchcmp is deprecated in favor of benchstat: https://pkg.go.dev/golang.org/x/perf/cmd/benchstat
benchmark                          old ns/op     new ns/op     delta
BenchmarkFinalExponentiation-2     487347        434029        -10.94%
[ec2-user@ip-172-31-25-164 ~]$ benchcmp old-fe-bls24.log new-fe-bls24.log
benchcmp is deprecated in favor of benchstat: https://pkg.go.dev/golang.org/x/perf/cmd/benchstat
benchmark                          old ns/op     new ns/op     delta
BenchmarkFinalExponentiation-2     1149723       1008101       -12.32%

[yelhousni]

N.B.: The current tradeoff of (inverse cost / series of 0's size) allows only BLS24-315 to benefit from the Montgomery BatchDecompression() trick.