[crypto/ec] Ladder tweaks

[crypto/ec] Ladder tweaks

- Convert to affine coords on ladder entry. This lets us use more efficient
  ladder step formulae.

- Convert to affine coords on ladder exit. This prevents the current code
  awkwardness where conversion happens twice during serialization: first to
  fetch the buffer size, then again to fetch the coords.

- Instead of projectively blinding the input point, blind both accumulators
  independently.

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/11435)