Verifier needs to perform a subgroup check on proof points

[ggutoski]

@kobigurk has observed that the gnark verifier currently does not check a purported Groth16 proof to ensure that its points are actually in the correct elliptic curve subgroup (G1 or G2). It is known that these checks are necessary to thwart certain attacks on the protocol. See 2019/814 - Faster Subgroup Checks for BLS12-381 and references therein for state-of-the-art solutions to this issue.