Add the `deferred` module with a `DeferredField` trait that enables
accumulating multiple unreduced products before performing a single
reduction. The trait uses an accumulation-based API: callers feed
factor pairs into an `Accumulator` via `mul_accumulate` /
`square_accumulate`, then call `reduce` once at the end.
For now, both Fp and Fq implement the trait with `Accumulator = Self`,
performing eager reduction on each accumulation. A later commit will
swap in a wide accumulator that defers reduction for real.
The module is feature-gated behind the `deferred` feature flag.
Now that we have a default implementation of `SqrtRatio::sqrt_ratio`, we
can use it and `FieldExt` in no-std environments.
We introduce an `alloc` feature flag to form a common feature dependency
between `std` and `sqrt-table`. It is currently unused directly, but
will be used after `CurveAffine` is refactored to remove the `std`
dependency.
Closeszcash/pasta_curves#25.
We re-introduce the Tonelli-Shank square root algoritm that was removed
in zcash/halo2#120, to use in no-std mode (the table-based impl requires
allocations, and also uses 29kiB of memory which is a problem for
constrained environments that typically need no-std).
