Scalar mul could conditionally negate instead of subtract

[Gregor Mitscha-Baude]

An idea that I wasn't yet able to explore when working on scalar multiplication in o1js is the following:

Instead of

• representing the scalar as (t_is_odd, t_high)
• and scaling by 2*t_high + 1 + 2^255
• and conditionally subtracting to get t + 2^255

we could

• represent the scalar as (t, t_negate), where 2*t + 1 + 2^255 < 2^254, and we might negate the whole expression to enforce that condition
• scale by 2*t + 1 + 2^255
• and in the end, conditionally negate the result

This should be more efficient because negation is cheaper than curve addition, and conditionally picking a field element (the y coordinate for negation) is cheaper than conditionally picking a point