feat: add ct functions and new operations to secp256k1

[LesterEvSe]

• This PR suggests a bug fix and I've added the necessary tests.
• This PR introduces a new feature and I've discussed the update in an Issue or with the team.
• This PR is just a minor change like a typo fix.

---

[apoelstra]

For computing vH it's plausibly cheaper to directly compute this by an addition ladder. If the asset ID is known, you can embed a lookup table in your program which is potentially very fast (at an extreme, you could plausibly compute an entire 2^64 sized lookup table and then it's one lookup, though with a deep merkle tree). But even if it's not, because you can bound the size of v at 2^64 even just double-and-adding 64 times is probably cheaper than a linear verify.

Then I suspect that to verify an asset commitment, it'd be faster to take an "exact value proof", which is basically a Schnorr signature on commit - vH, rather than to take an abf and vbf.

Lots of options here. We should probably make a harness that can generate all these, including lots of different kinds of lookup tables, and compare the cost.