Using a sliding window method with pre-computed values of multiples of
the generator point, obtain far more efficient performance for the
special case where G = P in the scalar multiplication kP.

By using a safe selection algorithm for pre-computed values and no
branches in the main loop, the algorithm leaks no less information about
its inputs than the current Montgomery ladder.

For performance. This implies the need to get generator points from C as
well. The pre-computed tables are stored in static memory, and computed
lazily.

This partly reverts commit 28abf53.