Fix wnaf_table overallocation

[42Pupusas]

For window size w, wNAF digits have max magnitude 2^(w-1) - 1. The table is indexed by |digit| / 2, so the maximum index is (2^(w-1) - 1) / 2 = 2^(w-2) - 1, requiring 2^(w-2) entries.

The previous 2^(w-1) allocation computed twice as many odd multiples as needed, wasting point additions during table setup.

Benchmark

Ran the RustCrypto/k256 benches and gave around 20% improvements for hot paths, albeit on a noisy system.

schnorr/verify    time:   [52.109 µs 52.232 µs 52.374 µs]
                             change: [−26.395% −23.813% −21.156%] (p = 0.00 < 0.05)
                             Performance has improved.
 Found 28 outliers among 200 measurements (14.00%)
  28 (14.00%) high mild

Correctness

In an effort to make review easier, I have also demonstrated a Lean proof verifying the above claims.