the same as carryPropagate, except with // wider inputs: we take the carry for each coefficient by shifting it right // by 51, and add it to the limb above it. The top carry is multiplied by 19 // according to the reduction identity and added to the lowest limb. // // The largest coefficient (r0) will be at most 111 bits, which guarantees // that all carries are at most 111 - 51 = 60 bits, which fits in a uint64. // // r0 = a0×b0 + 19×(a1×b4 + a2×b3 + a3×b2 + a4×b1) // r0 < 2⁵²×2⁵² + 19×(2⁵²×2⁵² + 2⁵²×2⁵²...