This is a rewrite of the x25519 code, that generalizes support for
common primitives based on the same finite field.

- Low-level operations can now be performed over the curve25519 and
edwards25519 curves, as well as the ristretto255 group.
- Ed25519 signatures have been implemented.
- X25519 is now about twice as fast.
- mem.timingSafeEqual() has been added for constant-time comparison.

Domains have been clearly separated, making it easier to later add
platform-specific implementations.