Dangerous lack of subgroup check for G2 groups in bls

### What is wrong?

G2 point decompression function goes through all the regular checks same as for G1 (checks that coordinates are in field and that the point is on curve). However, there is no subgroup check, which presents a security vulnerability, especially if someone tries to use this code for distributed key generation (then you can mount the baby sharks (https://medium.com/zengo/baby-sharks-a3b9ceb4efe0) attack).

### How can it be fixed

Add subgroup checks when decompressing G2 points

Start at the BLS G2 point decompression function and compare its validation flow with the existing G1 checks. Add coverage for subgroup validation during G2 decompression, then verify that valid points still decode and non-subgroup points are rejected.

Written by the indexing model from the issue text.