Fix edge case in expand_root_of_unity

[jtraglia]

Valgrind pointed out usage of an uninitialized value in our tests. Since this is part of the trusted setup initialization, I expect this would never happen, but good to fix nevertheless.

==501666== Conditional jump or move depends on uninitialised value(s)
==501666==    at 0x40A5A6: fr_is_one (in /home/devops/jtraglia/c-kzg-4844/src/test_c_kzg_4844)
==501666==    by 0x40A556: expand_root_of_unity (in /home/devops/jtraglia/c-kzg-4844/src/test_c_kzg_4844)
==501666==    by 0x40952E: test_expand_root_of_unity__fails_wrong_root_of_unity (in /home/devops/jtraglia/c-kzg-4844/src/test_c_kzg_4844)
==501666==    by 0x4031C1: tt_execute (in /home/devops/jtraglia/c-kzg-4844/src/test_c_kzg_4844)
==501666==    by 0x403AA3: main (in /home/devops/jtraglia/c-kzg-4844/src/test_c_kzg_4844)

In the following test, we provide the wrong root of unity, which causes the loop in expand_root_of_unity to break early. Here, the width is 256 but the look will break at 128 (because it encountered a value of one).

c-kzg-4844/src/test_c_kzg_4844.c

Lines 1719 to 1727 in b2e4149

	static void test_expand_root_of_unity__fails_wrong_root_of_unity(void) {
	C_KZG_RET ret;
	fr_t roots[257], root_of_unity;
	blst_fr_from_uint64(&root_of_unity, SCALE2_ROOT_OF_UNITY[7]);
	ret = expand_root_of_unity(roots, &root_of_unity, 256);
	ASSERT_EQUALS(ret, C_KZG_BADARGS);
	}

In expand_root_of_unity, if the loop breaks early, the final check will occur on an uninitialized value:

c-kzg-4844/src/c_kzg_4844.c

Lines 1563 to 1567 in b2e4149

	for (uint64_t i = 2; !fr_is_one(&out[i - 1]); i++) {
	CHECK(i <= width);
	blst_fr_mul(&out[i], &out[i - 1], root);
	}
	CHECK(fr_is_one(&out[width]));

I also added CHECK(width >= 2) as a sanity check and changed the loop to be more "natural" IMO.

[asn-d6]

Can we just add the check CHECK(i == width); without changing the loop logic?

I feel like this is a non-trivial loop logic and the less we change it the better.

[jtraglia]

IIRC you'd have to compare i to width - 1. It's not as pretty. I think this way is safer.

[ppopth]

Even though, it changes the loop logic, I think the latter is a lot easier to understand (like you can know the maximum number of iterations immediately)

[asn-d6]

Sounds good. LGTM!