feat: Added efficient field comparisons for bn254

[sirasistant]

Description

Adds efficient field comparisons for the bn254 field.

Problem*

Previously, field comparisons were made by decomposing to bytes. This PR optimizes this by decomposing the field in an unconstrained function.

Summary*

Field comparisons via byte decomposing had a cost of ~850 constraints. This PR adds some bn254 specific functions to:

• assert_gt / assert_lt : ~77 constraints
• gt/lt: ~190 constraints

Additional Context

@zac-williamson explanation:

decompose(x: field) returns xlo, xhi as fields
The algorithm requires knowledge of the field modulus p , as well as it’s 128-bit components plo, phi such that p = plo + phi * 2^{128}

plo, phi need to be defined as circuit constants

in an unconstrained function:

1. compute xlo, xhi such that x = xlo + 2^{128}xhi
2. compute borrow: bool such that borrow = xlo > plo

in a constrained function:

1. assert xlo < 2^{128}
2. assert xhi < 2^{128}
3. assert(x == xlo + 2^{128}xhi
4. let rlo = plo - xlo + borrow*2^{128}
5. let rhi = phi - xhi - borrow
6. assert rlo < 2^{128}
7. assert rhi < 2^{128}

---

The purpose of rlo, rhi is to ensure that xlo + 2^{128}xhi does not wrap around the field modulus p

With a decompose method implemented, a assert_gt(a, b) method can be built

assert_gt(a: field, b: field)

1. let alo, ahi = decompose(a)
2. let blo, bhi = decompose(b)

If a > b then we want a - b - 1 >= 0 . We can evaluate this relation over each of the 128-bit slices:
in an unconstrained function, let borrow: bool = (alo <= blo)
in a constrained function:

1. let rlo = alo - blo - 1 + borrow*2^{128}
2. let rhi = ahi - bhi - borrow
3. assert rlo < 2^{128}
4. assert rhi < 2^{128}

---

Also a gt/lt method is provided leveraging a hint + assert_gt.

Documentation*

Check one:

• No documentation needed.
• Documentation included in this PR.
• [Exceptional Case] Documentation to be submitted in a separate PR.

PR Checklist*

• I have tested the changes locally.
• I have formatted the changes with Prettier and/or cargo fmt on default settings.