fix(fq12): branch DecompressKarabina on g3 rather than g5

[4waan]

What's wrong

DecompressKarabina and BatchDecompressKarabina guard on x.C1.B2, commented
/* g3 == 0 */. The else arm of that same if divides by 4 * x.C1.B0,
commented // t1 = 4 * g3. Two different coordinates are called g3 in one function.

The guard tests g5. It should test g3.

Consequences

Both silent:

input	branch taken	result
g3 == 0, g5 != 0	else, divides by 4 * g3 == 0	Div maps 0 to 0, so g4 = 0
g5 == 0, g3 != 0	if, computes 2 * g1 * g5 / g2 = 0	g4 = 0

The if arm has never run for the case it was written for.
Only fq12over6over2 disagreed.

Verification

• 19227 elements, exhaustive, 3 parameter sets. CyclotomicSquareCompressed matched a genuine squaring 19227/19227.
• No live-path change.
• 7 planted mutations all caught,

Severity

Not 2^-508. These inputs are constructible in polynomial time.

G_Φ2 is rationally parameterised by Hilbert 90, G_Φ6 is its image under
x -> x^(p²+1), and x -> x^(p²) is diagonal on the six coordinates. So
y(z) = W/conj(W) with W = z * Frob2(z) is a low-degree rational map onto G_Φ6.
Restrict z to a line and g3(y) = 0 becomes a degree-12 univariate over Fp2.
Root-finding it gives genuine cyclotomic elements with g3 = 0, g2 != 0, y != 1 on
bls12-381 (first random line) and bn254 (second), in seconds.