Add secp256k1_scalar_mul_shift_var
Avoid division when decomposing scalars

- In secp256k1_gej_split_exp, there are two divisions used. Since the denominator is a constant known at compile-time, each can be replaced by a multiplication followed by a right-shift (and rounding).
- Add the constants g1, g2 for this purpose and rewrite secp256k1_scalar_split_lambda_var accordingly.

Rebased-by: Pieter Wuille
Convert lambda splitter to pure scalar code.

This enables the use of the endomorphism optimization without bignum.
Remove unused num functions