Wnaf Optimizations

[42Pupusas]

This is the base work for integrating optimizations discussed here with the proper shared types.

• Fix wnaf_table to allocate 2^(w-2) entries instead of 2^(w-1): For window size w, wNAF digits have max magnitude 2^(w-1) - 1, so the table is indexed by |digit| / 2 with max index 2^(w-2) - 1. The previous 2^(w-1) allocation computed twice as many odd multiples as needed, wasting point additions during table setup. For w=5 this halves table construction from 16 to 8 entries.
• Add WnafScalar::from_le_bytes: Constructs wNAF digits from a raw little-endian byte slice, enabling callers to pass pre-decomposed scalars shorter than the full field representation. This is needed for endomorphism-based (GLV) scalar multiplication where a 256-bit scalar is split into two ~128-bit halves — using 17-byte inputs instead of 32-byte produces ~half the wNAF digits and ~half the doublings in the evaluation loop.
• Add WnafBase::multiscalar_mul_array: Fixed-size array variant of multiscalar_mul that avoids the two collect::<Vec<_>>() heap allocations the iterator-based version requires to build the slice-of-slices for wnaf_multi_exp.
• Pre-size Vec allocations: WnafScalar::new, from_le_bytes, and WnafBase::new now use Vec::with_capacity sized to the exact output length, avoiding potential reallocation during wnaf_form/wnaf_table.

Verification

• cargo test — passes (group crate)
• Downstream testing against RustCrypto/elliptic-curves with patch.crates=io pointing at this branch: 211 tests pass across k256 (90), p256 (39), p384 (34), p521 (26), sm2 (22).
• Benchmarked k256 Schnorr verify (cargo bench --bench schnorr): the table size fix alone recovered ~10% regression from using the group crate's wNAF vs a hand-rolled implementation; combined with multiscalar_mul_array and pre-sizing, total performance matches the hand-rolled baseline (~52 µs)
• Profiled with perf record + perf report to confirm the table fix halved time spent in wnaf_table (14.6% → 8.4% of total verify time)
• DHAT heap profiling confirmed multiscalar_mul_array eliminates 2 of 10 per-call heap allocations

@tarcieri I can add the dhat profiling harness if interested, but it adds a dev dependency so did not include it