Fix/reduce constraints eddsa

[ThomasPiellard]

This PR removes the splitting of S in S1+2^bS2 in the EDDSA snark circuit.

• Breaking changes:

type Signature struct {
	R twistededwards.Point
	S1, S2 frontend.Variable // S1+2^b S2 = S
}

-->

type Signature struct {
	R twistededwards.Point
	S frontend.Variable
}

The splitting was due to an earlier version of gnark-crypto where S was reduced modulo the number of points of the twisted Edwards instead of the group order of the base point.

A twisted Edwards on Z/rZ has at most N=r+2*sqrt(r)+3 points because there are 2 points of multiplicity 2. The group that is used for eddsa contains at most N/2 points because there is a point of order 2 on the twisted Edwards. Therefore l<r.