Merge bitcoin-core/secp256k1#1673: Assert field magnitude at control-flow join

3a4f448cb4 Assert field magnitude at control-flow join (Peter.Dettman)

Pull request description:

ACKs for top commit:
  sipa:
    ACK 3a4f448cb4
  jonasnick:
    ACK 3a4f448cb4

Tree-SHA512: b78b500458597104a1d76985b0b619886f6dc2a4b136ca7ee37823796c8920041459b5674985bb4e1cc93ee7be5a702f6a84f8e5ddd25b97da6babacf0f34c0e

src/ecmult_const_impl.h

@@ -373,6 +373,8 @@ static int secp256k1_ecmult_const_xonly(secp256k1_fe* r, const secp256k1_fe *n,
         }
     }
 
+    SECP256K1_FE_VERIFY_MAGNITUDE(&g, 2);
+
     /* Compute base point P = (n*g, g^2), the effective affine version of (n*g, g^2, v), which has
      * corresponding affine X coordinate n/d. */
     secp256k1_fe_mul(&p.x, &g, n);