This commit adds the batch_create and batch_destroy APIs.
Relevant Links:
1. batch_scratch_size allocation formula is taken from bench ecmult:
https://github.com/bitcoin-core/secp256k1/blob/694ce8fb2d1fd8a3d641d7c33705691d41a2a860/src/bench_ecmult.c#L312.
2. aux_rand16 param in batch_create enables synthetic randomness for
randomizer generation: sipa/bips#204.

This commit refactors ecmult_strauss_batch and adds _batch_verify API.

The current ecmult_strauss_batch only works on empty scratch space. To
make batch_verify compatible, we need ecmult_strauss_batch to support a
scratch space pre-filled with scalars and points. So, it was refactored
to do exactly that.

The batch_verify API always uses the Strauss algorithm. It doesn't switch
to Pippenger (unlike ecmult_multi_var). ecmult_pippenger_batch represents
points as secp256k1_ge whereas ecmult_strauss_batch represents points as
secp256k1_gej. This makes supporting both Pippenger and Strauss difficult
(at least with the current batch object design). Hence, batch_verify only
supports Strauss for simplicity.

This commit adds the batch APIs:

1. batch_add_schnorrsig
    Adds a Schnorr signature to the batch.

2. batch_add_xonlypub_tweak_check
	Adds a tweaked x-only pubkey check to the batch.

3. batch_usable
	Checks if a batch can be used by _batch_add_* APIs.

**Side Note:**
Exposing batch_add_schnorrsig in the secp256k1_schnorrsig.h header
file (with batch module header guards) will force the user to define
ENABLE_MODULE_BATCH during their code compilation. Hence, it is in a
standalone secp256k1_schnorrsig_batch.h header file. A similar argument
could be made for batch_add_xonlypub_tweak_check.

This commit adds an example C program using the batch API.

GNU Autotools and CMake will compile this example only if both batch and
schnorrsig modules are enabled.

This commit adds the following tests:
	1. GitHub workflow
	2. Batch API tests (ordered)
	3. Tagged SHA256 test
	4. BIP340 test vectors: https://github.com/bitcoin/bips/blob/master/bip-0340/test-vectors.csv
	5. Large random test for `strauss_batch` refactor

This commit adds the following tests:
	1. Random bitflip test for randomizer generating function
	2. Random bitflip in Schnorr Signature (batch_add_schnorrsig test)
	3. NULL arg tests (for both batch_add APIs)

This commit adds benchmarks for:
    1. Batch verifying Schnorr signatures
    2. Batch verifying tweaked pubkey checks
    3. Normal tweaked pubkey check in extrakeys module

For batch verify benchmark, the number of sigs (or checks) in the batch
varies from 1 to SECP256K1_BENCH_ITERS with a 20% increment.

This commit generates two semi-log graphs that visualize the batch
verification speed up over single verification (y-axis) wrt the number
of signatures (or tweak checks) in the batch (x-axis). The input data
points are taken from the batch verify benchmark.

GNU plot was used to generate these graphs (plot.gp file). The instructions
to reproduce these graphs (on your local machine) are given in
doc/speedup-batch.md file.

The value of `STRAUSS_MAX_TERMS_PER_BATCH` was calculated (approx) from
the generated graphs.
Relevant discussion: #2 (comment)