Amend simd 0376 ed25519-zebra verification

[zz-sol]

This PR amends the 0376 signature verification.

Prior to this PR, simd-0376 uses purely zebra verification as per zip215. It is reported that zip215 deliberately allows for zero-encoded public key (this is not an issue for zcash as they do not use public keys for other purposes) which means, an attacker can forge signatures for any messages for a zero key (i.e. Pubkey::default()), widely used as a "disabled authority" sentinel.

We propose to use "reject small-order A" variant from the Taming the many EdDSAs paper instead of pure ZIP-215. Speficially

• reject non-canonical encodings of A and R,
• reject non-reduced S,
• reject small-order A and R,
• keep the cofactored equation as in zip-215.

[simd-bot]

Hello zz-sol! Welcome to the SIMD process. By opening this PR you are affirming that your SIMD has been thoroughly discussed and vetted in the SIMD discussion section. The SIMD PR section should only be used to submit a final technical specification for review. If your design / idea still needs discussion, please close this PR and create a new discussion here.

This PR requires the following approvals before it can be merged:

• At least one approval from a Anza team member: t-nelson, steviez, or bw-solana
• At least one approval from an Firedancer team member: ptaffet-jump, topointon-jump, 0x0ece, lidatong, ripatel-fd, or rexicon226

Once all requirements are met, you can merge this PR by commenting /merge.

[zz-sol]

tagging @robre @samkim-crypto @Rexicon226 for review

[robre]

lgtm