* Updated to new curve25519 scalar API
* Made ExpandedSecretKey.scalar_bytes unclamped; clamping occurs in all scalar-point multiplication
* Added legacy compat deprecation notice
* Removed deprecation notice on check_scalar
* Removed unnecessary unwraps
* Add `Scalar` and `MontgomeryPoint` conversions
- Adds `SigningKey::to_scalar` to extract the private scalar
- Adds `VerifyingKey::to_montgomery` to map the verifying key's
`EdwardsPoint` to a `MontgomeryPoint`
- Also adds corresponding `From<&T>` impls which call the inherent
methods.
This is useful for systems which are keyed using Ed25519 keys which
would like to use X25519 for D-H. Having inherent methods means it's
possible to call these methods without having to import `Scalar` and
`MontgomeryPoint` from `curve25519-dalek`.
This is of course a bit circuitous: we could just multiply `Scalar` by
`EdwardsPoint` and use the resulting `EdwardsPoint` as the D-H shared
secret, however it seems many protocols have adopted this approach of
mapping to `MontgomeryPoint` and using that for the shared secret, since
X25519 is traditionally used for ECDH with Curve25519.
* Add reference to eprint 2021/509
* Basic X25519 Diffie-Hellman test
