Bernstein-Yang modular inversion algorithm

[tarcieri]

Adapted from: privacy-scaling-explorations/halo2curves#83

Original code is Apache 2.0+MIT. Attribution has been added to the top of the module.

See also: #227

cc @dignifiedquire @fjarri @mratsim

[tarcieri]

Hmm, re: 32-bit support, I was attempting to go off of what section 12.3 of https://gcd.cr.yp.to/safegcd-20190413.pdf had to say regarding the number of bits/iterations, but it seems something else is amiss

[tarcieri]

Going to back out attempts at 32-bit support. The paper alludes to a jump32divsteps2 function in section 12.3 but I'm not able to find any more information beyond that.

That does leave the issue of how to assemble a [u64] input on 32-bit platforms. On little endian targets it can be a pointer cast, but big endian targets will need an endianness swap.

[tarcieri]

Since we need to convert big integers from a saturated representation to an unsaturated 62-bit representation (and back) to perform Bernstein-Yang anyway, I changed the conversion functions to operate over Word-based inputs and outputs, leaving the implementation otherwise as-is.

That seems like enough to make the proptests pass on both 32-bit and 64-bit platforms. I haven't fully integrated it into the various modular inverse functions yet, but this is enough to get started.

[tarcieri]

Note: I do intend to encapsulate this and get it out of the public API