[SECP256K1] Optimization: use formulas instead of lookup tables for cancelling g bits

Summary:

This only seems to be a win on 64-bit platforms, so only do it there.

Partial backport of secp256k1#831:
https://github.com/bitcoin-core/secp256k1/pull/831/commits/b306935ac12bb24fd931d735b4dfc07f707e7447

Depends on D9409.

Test Plan:

ninja check-secp256k1

Reviewers: #bitcoin_abc, majcosta

Reviewed By: #bitcoin_abc, majcosta

Differential Revision: https://reviews.bitcoinabc.org/D9410