perf: improve PLONK in-circuit verification

[ivokub]

Gathering ideas from #880:

• unsafe additions for scalar mul
• endomorphisms for in circuit scalar mul
• VDF for exponentiation ("I gave the Wesolowski VDF approach a try to compute efficiently z^(2^T) mod n but it's not sound since n is a known prime (the root finding problem is easy). Also 2^T is small in our use-case compared to n so reducing the exponent modulo n-1 (the Euler totient) is not helpful neither.")
• MSM in-circuit
• For 2-chains, use twisted Edwards complete formulae for windowed scalar multiplication might be worth it.
• add option to enforce subgroup checks (as in Groth16)