ZIR-181: Add Elliptic Curve BigInt circuits

[tzerrell]

Adds Elliptic Curve functions/ZKRs based on the BigInt dialect, with operations for verifying add/sub/neg/mul/double plus point equality and verifying point on curve. Includes curve parameters for secp256k1 as well as a tiny custom curve for testing purposes.

This represents curves as Weierstrass curves and points in affine coordinates. This is good for fast computations in our particular case, but does preclude representing the zero point or calculations involving it, causing some minor incompleteness (which is typically cryptographically irrelevant). Due to the lack of control flow in the recursion circuit, this is slightly more incomplete than similar systems, particularly in multiply, where if a zero would be computed when multiplying by a scalar that differs from the actual scalar by a single bit, then the multiply can't go through (as both branches are computed and combined during the double-and-add algorithm). An alternative approach using an arbitrary offset point would allow people to avoid this problem in specific cases (by choosing a different arbitrary offset point), although the general problem would still exist (it's just in different places depending on the offset), and in that implementation this arbitrary offset must be provided to all multiplies, which did not seem like the best tradeoffs to me.

This produces a lot of ZKRs for unit testing. This can make compile/testing time a bit slow -- I've tried to trim them to achieve a good balance of testing perf & coverage, but I'm definitely open to suggestions for improvement here.

This includes @shkoo's work making compile times faster through BigInt macros (7b2e4bf)

Developed in conjunction with risc0/risc0#2371, which includes a test suite.

[shkoo]

Can't speak to the math stuff, but the rest looks good!

[tzerrell]

(I force-pushed the last few commits to mollify the verified-commit checker. No changes to the code in these new commits)