Introduce an explicit clear-cofactor method

[mmagician]

There are faster ways to clear the cofactor that multiplying by h, see e.g. https://eprint.iacr.org/2021/1130.pdf.
In this PR I expose a method clear_cofactor on AffineCurve, which SW/TE-ModelParameters implement with a default mul_by_cofactor() call, but which allows upstream implementers of these traits to override with a more efficient implementation.

As an example, I've added a concrete speedup for bls12-381 G1 (see companion PR in curves) which employs multiplication by a smaller scalar than the cofactor itself.

Description

related to #308

---

Before we can merge this PR, please make sure that all the following items have been
checked off. If any of the checklist items are not applicable, please leave them but
write a little note why.

• Targeted PR against correct branch (master)
• Linked to GitHub issue with discussion and accepted design OR have an explanation in the PR that describes this work.
• Wrote unit tests
• Updated relevant documentation in the code
• Added a relevant changelog entry to the Pending section in CHANGELOG.md
• Re-reviewed Files changed in the GitHub PR explorer

[Pratyush]

The effect of these methods is to mul_by_cofactor, right? I.e., if I have a group element g that's already in the prime order subgroup, does this assertion hold: assert_eq!(g.clear_cofactor(), g.mul_by_cofactor())?

[mmagician]

Not necessarily. AFAIU the point of clearing the cofactor is to return a point in the prime order subgroup, but different techniques for clearing will return different points with the same order.
So if there's a non-default clear_cofactor implementation (like here), the above assertion won't hold, just as assert_eq!(g, g.mul_by_cofactor()) won't hold now.

[mmagician]

Is this PR ok to go ahead with? It's necessary for #430.