Replace crypto_scalarmult with TweetNaCl version

Before we had signatures, I ported crypto_scalarmult not from TweetNaCl, but from NaCl's reference implementation. Now that we have all needed primitives, which are used in ed25519, we can also replace curve25519 with the port of TweetNaCl's version.

It is around 5x slower. Since the goal of this implementation is not speed, but auditability, it's fine. Instead of stuffing faster implementation into nacl.js, we should create nacl-fast.js, a drop-in replacement of nacl.js with  faster implementation of Curve25519 (which is being replaced by this pull request) and faster XSalsa20 (which is already lying somewhere on my hard drive).