perf(bls12-381): eliminate finalexp ~naively

[yelhousni]

Description

Applying https://eprint.iacr.org/2024/640.pdf as in #1143 and #1155 for BLS12-381 doesn't work (#1143 (comment)). Alternatively we can apply theorem 1 of that paper to check f == c^r instead. @feltroidprime suggested to check instead that f^k == c^(q-u) where k=(u-1)^2/3 using a Frobenius map and 2 optimized addition chains. This PR implements their idea after pushing f to the cyclotomic subgroup. The exponentiation are done then using Granger--Scott algorithm.

TODO:

• use Karabina12345 instead of Granger--Scott.
• include c^(-u) in the the Miller loop computation.
• do both

Type of change

• New feature (non-breaking change which adds functionality)

How has this been tested?

The existing TestPairingCheckTestSolve works for this.

How has this been benchmarked?

This PR saves 681,769 scs or 199,105 R1CS in a BLS12-381 pairing.

Checklist:

• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my fix is effective or that my feature works
• I did not modify files generated from templates
• golangci-lint does not output errors locally
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

[ivokub]

I don't get the math, but the implementation looks good :)