Add batch verification failure blame

[AaronFeickert]

If verification of a batch of proofs fails, it is not possible to directly identify which proofs in the batch are invalid. There are cases in which a verifier is likely to want this information.

The most comprehensive approach would introduce two different "verify-with-blame" functions. One would attempt full batch verification; if this fails, it checks each proof in succession and returns a list of all failures. The other would also attempt full batch verification; if this fails, it uses a binary search to return a single failure. The former runs with linear complexity in the size of the batch, while the latter runs with logarithmic complexity.