'clamp' private key value to harden default curve25519 function and avoid unsafe keys; former behaviour is still available via curve25519_raw for potential use in algorithms that pre-validate the private key.