Reduce number of PoT checkpoints 2x

[nazar-pc]

Since we have unusual use of AES, we don't really care whether we're doing encoding or decoding, we have both inputs and outputs either way.

If that is the case, why don't we cut number of checkpoints in half and for every sub-interval (between two checkpoints) do this instead:

[encoding]-> | <-[decoding]

Essentially run half of iterations in forward and half of iterations in backward direction, then compare that both resulted in the same middle value.

This way with 8 checkpoints instead of 16 we still get the same instruction-level parallelism and the same verification performance (as I have confirmed with benchmarks).

Code contributor checklist:

• I have read, understood and followed contributing guide

[dariolina]

Updated the spec accordingly. Thanks for this idea!