Prove that endoscaling never produces a scalar in the 2^32 multiplicative subgroup

[daira]

This eliminates a possible reason for imperfect zero-knowledgeness of proving, when using the endoscaling optimization.

It is possible to prove this by exhaustive search with an efficient shortest-vector algorithm in dimension 2, e.g. algorithm 3 of https://eprint.iacr.org/2020/454.pdf . We need the version with the stricter test at step 8, so that we get a shortest vector. For each possible subgroup element, if the norm of this vector is greater than the maximum possible norm corresponding to an endoscalar, then that subgroup element cannot be an endoscalar. Some back-of-the-envelope calculations of the cost of the exhaustive search seem to suggest that it could be done in less than 24 hours (per field), based on the performance of @str4d's PR to add Pornin's algorithm to curve25519-dalek: dalek-cryptography/curve25519-dalek#323