Various MuSig Improvements

[jonasnick]

API

• Make aborts identifiable, so that signers can be blamed if they send garbage. In particular, this means updating the partial_sig_agg failure case to return the index of the offending sig.
• Allow signing variable length messages (i.e. with length != 32) as proposed for BIP-340 by adding an msglen argument to all function currently only taking an msg32.
• Support sign-to-contract (@dr-orlovsky)
• Consider adding a flag to the secp256k1_musig_partial_sign interface. If true it would do a partial signature verification before returning (H/T @robot-dreams).i
• Consider treating pre_sig64 argument of musig_adapt and musig_extract_adaptor as secret (for constant-timeness test)

Internal

• musig_nonce_gen currently rejects session_id32=0 if there's no seckey. This check could be stronger and reject weak entropy counters, for example in a endianness-independent way by checking that the middle 16-bytes are not all 0 (H/T @robot-dreams).
• Unify handling of cryptographically unreachable code, i.e., always use VERIFY_CHECK instead of returning 0.
• Keep up to date with test vectors from the MuSig spec (Update musig module to BIP MuSig2 v1.0.0-rc.3 #211)
• Strengthen nonce generation by feeding addresses of arguments to the function (Strengthen MuSig nonce gen by feeding addresses of args #152)
• Reenable efficient multiexponentiation (ecmult_multi) in pubkey_agg when confidence in its implementation is higher.
• Fix TODO items: "use multiexp to compute -s*G + e*mu*pubkey + aggnonce[0] + b*aggnonce[1]" and "Cache mu".