perf: implement BGM17 modification for Groth16 verification key

[ivokub]

The modification allows to take 𝛾=G2, allowing for more efficient Groth16 batched verification. However, as far as I understand this requires adding additional elements in the verification key.

Maybe we can have some kind of modification instead so that in case we do not need batched verification, then can use current implementation as is and only use the variation when needed?

cc. @yelhousni, @ThomasPiellard