subgroup check

[swasilyev]

Now the 2 points (the aggregated proof and the accumulator) that go into the pairing are subgroup checked. Then may be the points in the proofs don't have to be checked at the deserialization. I've never seen a proof of that. @AlistairStewart had a hackmd on that that i didn't find comprehensible.

I would also do the same for a standalone proof for consistency, but couldn't as it doesn't really make sense in the abstract setting.

// ··End: Verify Batch KZG ........................................................1.444ms -- base 1
// ··End: Verify Batch KZG ........................................................1.753ms -- check 1
// ··End: Verify Batch KZG ........................................................4.382ms -- base 10
// ··End: Verify Batch KZG ........................................................4.614ms -- check 10

So ~0.15 ms per a multiplication by the scalar field size. If we specialize to bls12-381 that would be may be 2x better due to the endomorphism.