Add option to use pari for small_roots

[grhkm21]

Use pari.zncoppersmith as an alternative Coppersmith implementation for small_roots.

I decided to make pari the default because in my testings (in many practical cases, not really "edge cases") it outperforms Sage's default ("basic") implementation, both in speed and strength - see the added test for example.

[grhkm21]

Hmm, it seems that the pari zncoppersmith errors quite often for some reason (stack overflow) - I believe they keep trying to incrementing the constructed matrix size until the theoretical limit. Maybe changing the default to pari isn't a good idea? Any opinions?

[user202729]

Actually this would be a breaking change: previously small_roots(algorithm="pari") would still work, the algorithm= is just passed directly to .LLL() which it accepts.

   AVAILABLE ALGORITHMS:

   * "'NTL:LLL'" -- NTL's LLL + choice of "fp"

   * "'fpLLL:heuristic'" -- fpLLL's heuristic + choice of "fp"

   * "'fpLLL:fast'" -- fpLLL's fast + choice of "fp"

   * "'fpLLL:proved'" -- fpLLL's proved + choice of "fp"

   * "'fpLLL:wrapper'" -- fpLLL's automatic choice (default)

   * "'pari'" -- pari's qflll

Maybe rename the new algorithm= to small_roots_algorithm=, the old algorithm= to lll_algorithm=, and deprecate the old algorithm=?

that is, if the zncoppersmith() is still faster than the old LLL(algorithm=pari).

---

Another alternative I can think of is algorithm="pari_zncoppersmith being treated as a special case.

Worst case (if default to pari isn't better in all cases) you can try to do something such as (pseudocode)

t = Timer(5, lambda: warning("looks like small_roots() is taking a long time, try using algorithm='pari'?")
B = B.LLL()
t.cancel()

then the user still get notification to possibly change, but only if it's slow.

[github-actions]

Documentation preview for this PR (built with commit 1b57621; changes) is ready! 🎉
This preview will update shortly after each push to this PR.

[grhkm21]

I'll fix the algorithm keyword first. I think it'll be a bad idea to have lll_algorithm, we should just keep the old algorithm, but indeed rename the current algorithm to small_roots_algorithm.

Also, as the example suggests, pari is not only faster than Sage, but also stronger, but it errors sometimes. I don't think there's an objective "better", but maybe we should catch the PariError and tell the user to try Sage instead (though 99.999% Sage will just return [])

[user202729]

If sage is likely to return [] anyway it seems more reasonable to just set the default to pari then.