Perf: KZG verification in a single point

[yelhousni]

This PR tradeoffs a scalar multiplication in G2 for a scalar multiplication in G1 in the case of KZG opening in a single point (Verify method). Kudos to @Tabaie for this observation.

-       // e([f(α) - f(a)]G₁, G₂).e([-H(α)]G₁, [α-a]G₂) ==? 1
+       // e([f(α)-f(a)+aH(α)]G₁], G₂).e([-H(α)]G₁, [α]G₂) == 1

We actually use KZG opening in multiple points (BatchVerifyMultiPoints) for PlonK. So this does not impact the PlonK verification time but only the public Verify method, which could be of independent interest. On AWS z1d.large:

benchmark                       old ns/op     new ns/op     delta
BenchmarkKZGVerify-2            708830        653944        -7.74%
BenchmarkKZGBatchVerify10-2     1084355       1035049       -4.55%

[Tabaie]

LGTM! Is there anything further to be gained from changing e([f(α)-f(a)+aH(α)]G₁], G₂).e([-H(α)]G₁, [α]G₂) == 1 to e([f(α)-f(a)+aH(α)]G₁], G₂) == e([H(α)]G₁, [α]G₂) and avoiding a GT multiplication or is that relatively trivial?

[yelhousni]

LGTM! Is there anything further to be gained from changing e([f(α)-f(a)+aH(α)]G₁], G₂).e([-H(α)]G₁, [α]G₂) == 1 to e([f(α)-f(a)+aH(α)]G₁], G₂) == e([H(α)]G₁, [α]G₂) and avoiding a GT multiplication or is that relatively trivial?

Writing it as e(_,_).e(_,_), allows for some computations to be shared between the two pairings (e.g. final exp and squares in the Miller loops).