Constant time scalar deserialize check

[elichai]

Currently, we use this logic to check that a scalar is canonical, this is also used in the deserialization of private nonces, which should be secret.
We want this to be constant time, which neither the bytes[31] & 240 == 0 check nor the from_canonical_bytes function are constant time.

two-party-musig2-eddsa/src/lib.rs

Lines 383 to 386 in e7b8b2e

	if bytes[31] & 240 == 0 {
	Some(Scalar::from_bits(bytes))
	} else {
	Scalar::from_canonical_bytes(bytes)

[elichai]

Opened a PR to solve this: dalek-cryptography/curve25519-dalek#384