Audit for "r.Exp(x, 1, m) wrong if r is initially non-zero"

[jeffallen]

In golang/go#22830, a posible security problem for bignum users is reported.

We need to find out if this affects us.

[jeffallen]

Things to review and the fixes:

./group/nist/residue.go:		new(big.Int).Exp(&p.Int, p.g.Q, p.g.P).Cmp(one) == 0
  ok
./group/nist/residue.go:	p.Int.Exp(&b.(*residuePoint).Int, &s.(*mod.Int).V, p.g.P)
  risky if V == 1, fix it
./group/nist/residue.go:	if g.G.Cmp(one) <= 0 || n.Exp(g.G, g.Q, g.P).Cmp(one) != 0 {
  q.Q != 1 because of isPrime(gQ) test above
./group/nist/residue.go:		g.G.Exp(h, two, g.P)
  two != 1
./group/nist/p256.go:	t2.Exp(t1, p2, m)
./group/nist/p256.go:	t3.Exp(t2, p3, m)
./group/nist/p256.go:	t4.Exp(t3, p4, m)
./group/nist/p256.go:	r.Exp(t4, p5, m)
  t2, t3, t4, r are new
./group/nist/p256.go:	r.Exp(r, p6, m)
./group/nist/p256.go:	r.Exp(r, p7, m)
./group/nist/p256.go:	r.Exp(r, p8, m)
  p6,7,8 != 1
./group/curve25519/el2.go:	b.Exp(a, &el.pp3d8) // b = a^((p+3)/8); b in {a,-a}
./group/curve25519/el1.go:	Y.Exp(&Y, &el.pp1d4).Mul(&Y, &Chiv).Mul(&Y, &t1)
./group/curve25519/el1.go:	X.Exp(&b, &el.pp1d4).Sub(&X, &etarp1)
  b, y, x are mod.Int
./group/mod/int.go:func (i *Int) Exp(a kyber.Scalar, e *big.Int) kyber.Scalar {
  func decl, false positive
./group/mod/int.go:	i.V.Exp(&ai.V, e, i.M)
  fixed
./group/mod/int.go:	v.Exp(&i.V, &v, i.M)
  function legendre is unused and should be nuked