x/crypto/curve25519,crypto/ed25519: reject low order points

[FiloSottile]

Rejecting low order points is not strictly necessary, but it helps root out behaviors that can come unexpected to protocol designers (like non-contributory DH, or signature:message:key not being 1:1:1). libsodium already does indiscriminately, and we should too.

https://github.com/jedisct1/libsodium/blob/cec56d867f741e66f78b9fde37d9081643599a2a/src/libsodium/crypto_scalarmult/curve25519/ref10/x25519_ref10.c#L90

This was suggested by Cas Cremers and Dennis Jackson as part of their upcoming work on revisiting small subgroup and invalid curve attacks.

[gopherbot]

Change https://golang.org/cl/183039 mentions this issue: crypto/tls: reject low-order Curve25519 points

[FiloSottile]

Curve25519 is covered by #32670, this issue is now about doing the check in crypto/ed25519.