Deterministic signatures

This implements deterministic (RFC6979-based) signatures using libsecp256k1's signing. Note that the test cases here were constructed using an earlier version of this patch (which implemented them on top of OpenSSL), so the deterministism has been consistent.

Earlier version of this message:
The OpenSSL-based deterministic signing implementation is likely very temporary, as we may switch to libsecp256k1 for signing soon (#5220), but it allows testing. The signatures generated by the OpenSSL and libsecp256k1 based implementations should be identical, so the test cases are already useful.

This is maybe not worth the hassle, but it's possible to do this with only a single `CSHA256`. In `Finalize` you'd put the output of `inner` into `hash`, then reset `inner`, write the outer key to it, write `hash` to it, then output to `hash`. This way you don't have any partial state hanging around in memory after finalization.