Optimization: move (2^COMB_BITS-1)/2 term into ctx->scalar_offset

It is unnecessary to recompute this term needed by the SDMC algorithm
for every multiplication; move it into the context scalar_offset value
instead.

src/ecmult_gen.h

@@ -103,7 +103,7 @@ typedef struct {
 
     /* Values chosen such that
      *
-     *   n*G == comb(n + (2^COMB_BITS-1)/2 + scalar_offset, G/2) + ge_offset.
+     *   n*G == comb(n + scalar_offset, G/2) + ge_offset.
      *
      * This expression lets us use scalar blinding and optimize the comb precomputation. See
      * ecmult_gen_impl.h for more details. */