Option to use constant-time multiscalar multiplication

[daira]

Ideally this would be a run-time rather than a compile-time option, so that clients of bellman such as zcashd could enable it based on a user setting. I know that constant-time MSM will be significantly slower; that's fine, and I think some people will want to take that trade-off.