Optimize variable-base scalar multiplication in the circuit

[daira]

Consider a 251-bit multiplication [x] P.

Edwards double-and-add requires 3252 constraints: 2 to select P or the zero point initially; 250 doublings at 5 constraints each; 250 conditional additions at 6 + 2 constraints each.

When P is large-order and x₂₅₀ is set, Montgomery double-and-add requires only 2254 constraints: 2 to convert to Montgomery; 250 doublings at 4 constraints each; 250 conditional additions at 3 + 2 constraints each; 2 to convert back to Edwards.

This is a 30.7% improvement — although it is not a drop-in replacement, even if consensus compatibility were not an issue.