Fix sampling of DLEQ challenge

[alxdavids]

The sampling of the DLEQ challenge value (c) is currently performed as the output of a SHA-512 evaluation for all supported ciphersuites. However, in the case of P-521, this is incorrect, as the size of the field is 521 bits.

We should update the draft specification to output this challenge as the output of an HKDF-Expand so that we can expand the output arbirtarily to the required number of bytes.

[armfazh]

A similar discussion is currently running in the hash-to-curve draft. In there, the hash-to-field function is being designed.

cfrg/draft-irtf-cfrg-hash-to-curve#202

[alxdavids]

@armfazh It would be good to get consensus on the best approach once the discussion is concluded. Until then I've written a PR that just uses HKDF-Expand-SHA512 instead of sampling using SHA512.