Faster scalar multiplication in G1.

[dfaranha]

Implements the GLV method for scalar multiplication in G1 in constant time.

The code includes a BETA constant (cube root of -1) to apply the GLV endomorphism, a GLV recoding algorithm to convert the scalar into subscalars and a regular recoding algorithm to compute a wNAF version with prescribed non-zero positions (due to Joye and Tunstall). The GLV and regular recoding methods are orthogonal and do not depend on each other if the former is deemed too risky.

The code probably can be simplified, but this version should start some discussion.

[ebfull]

This needs rebasing -- which we can do if you don't have time. However, I want to point out that the BETA constant introduced in this PR already exists in the g1 module but is different from the one you introduce (it's the other non-trivial cube root of 1). We'd need to remove that constant and use the one we already have which is also called BETA in the code. But would that interfere with this algorithm?

[dfaranha]

Changing the BETA for the other cube root of 1 will change the GLV vector basis for recoding. I can try computing it over Christmas, but you're right that it needs non-trivial rebasing.