Fix missing subgroup check

[nulltea]

Fixes:

• missing subgroup checks for public keys and signature
• missing y sign check

Details of y sign check implementation

• In rotation circuit: y sign is deferred from pubkey compressed bytes
• Signs are packed in 3 253bits integers and committed along with x coordinates using Poseidon hash
• In Step circuit: y sign is calculated as y*2 > p and used to open Poseidon commitment, which finishes cross-circuit y sign check

Notes:

• Not committing to y together with x is deliberate, as by doing so, one can introduce a possible DoS vector when the prover is permissionless (ref: V-SUC-VUL-004).