Add schnorrsig module which implements BIP-340 compliant signatures

[jonasnick]

This PR implements signing, verification and batch verification as described in BIP-340 in an experimental module named schnorrsig. It includes the test vectors and a benchmarking tool.
This PR also adds a module extrakeys that allows BIP-341-style key tweaking.

(Adding ChaCha20 as a CSPRNG and batch verification was moved to PR #760).

In order to enable the module run ./configure with --enable-experimental --enable-module-schnorrsig.

Based on apoelstra's work.

[jonasnick]

Replaced the chacha20 commit with a similar commit from secp256k1-zkp (BlockstreamResearch/secp256k1-zkp@c3794f9).

[apoelstra]

ACK except nit about sha object, bikeshedding about the module name, and also I did not check that the static test vectors match those in the BIP.

[gmaxwell]

Maybe we should consider adopting an anti-covert-channel warden workflow as the standard interface for this function?

[jimpo]

Nice! Such hype.

I skipped the tests, hoping to get back around to them.

[apoelstra]

@gmaxwell By anti-covert channel do you mean essentially sign-to-contracting random data? I would like this. One thing blocking it is that our nonce function does not take a secp context currently, which makes sign-to-contract unergonmic -- see in sighacker how the sign-to-contract context needs to contain a pointer to the secp context.

I think we should fix that but it should probably be in another PR.

[jonasnick]

Thanks @jimpo. I added a commit that addresses your comments.

[ghost]

how does this relate to #212 ?

[apoelstra]

#212 is not secure against rogue-key attacks nor does it commit to the public key being signed for.

[jonasnick]

and #212 was removed in #425

[real-or-random]

Oh I was not aware of this PR.
FYI, I suggested that a CSPRNG is not enough for batch validation and we need a hash function to generate the seed (https://github.com/sipa/bips/pull/15/files) but now I see that this PR is doing that anyway. :)

[jonasnick]

@real-or-random Thanks for the review. I added a commit to address your comments.

[jonasnick]

Added a test to increase the coverage of schnorrsig_sign. Now coverage in the schnorrsig module is 100% when excluding the lines that can't be hit. See https://htmlpreview.github.io/?https://raw.githubusercontent.com/jonasnick/secp256k1/schnorrsig-stats/coverage.src_modules_schnorrsig_main_impl.h.html

[jonasnick]

squashed and rebased on master

[jonasnick]

Added commit that will switch to little endian format when interpreting chacha20 output, replace chacha20 tests with test vectors from the RFC, add sipa's chacha20 test.