Allow each curve to provide its own `twin_mul` implementation. For now,
use the same implementation we've been using.

From BoringSSL commit 8d71d24.

Comment it out until it is modified to work.

Import the optimized nistz256 verification from BoringSSL.

Move more of the logic for the nistz256 multiplication into Rust.

Better match the Rust declarations of these functions. Prepare to
support more target platforms and more weird things (like P-521) that
by avoiding any kind of alignment assumptions at the language
boundary (or elsewhere).

On targets where we don't use nistz256, use the Fiat W-NAF-based
implementation instead.