ed448-goldilocks: more efficient isogeny maps between `EdwardsPoint` and `TwistedExtendedPoint`

[tarcieri]

The current implementation first converts to affine form, which involves an inversion.

libgoldilocks uses the following 4-isogeny maps between the untwisted and twisted forms which require no inversions and use only squarings, addition, subtraction, and multiplication:

Untwisted to twisted

https://github.com/otrv4/libgoldilocks/blob/d07cb5b423995bae1155702aa949846c95d855c1/src/goldilocks.c#L980-L994

Twisted to untwisted

https://github.com/otrv4/libgoldilocks/blob/d07cb5b423995bae1155702aa949846c95d855c1/src/goldilocks.c#L915-L928

See also:

• https://eprint.iacr.org/2011/135.pdf
• https://eprint.iacr.org/2014/027.pdf

[tarcieri]

I now see you were working on this in #1316 but that appears to still involve inversions

[daxpedda]

I implemented the algorithm for untwisted to twisted from https://github.com/otrv4/libgoldilocks/blob/d07cb5b423995bae1155702aa949846c95d855c1/src/goldilocks.c#L980-L994 in #1316.

I couldn't make the other one from https://github.com/otrv4/libgoldilocks/blob/d07cb5b423995bae1155702aa949846c95d855c1/src/goldilocks.c#L915-L928 work.

The ones you made in #1349 (comment) didn't work for me at all.