dsa: improve domain generation

Close to the logic of FIPS.186-4, but using fortuna.
.mli is the source of truth
changes

for great justice
a note for posterity
dsa: add non-fips extraction mode

because both fips and rfc6979 specify left-crop, as do openssl and the
traditional netscape ssl. so why do that, amirite?
fix Uncommon.Cs.fill
bit-precise cstruct shifts
dsa: factor out non-fips extraction mode

Adding flags just turns the api into a christmas tree of options, while giving
legitimacy to people that didn't bother to read the standards.

Interop with dsa implementations that have broken bits2int is now provided as an
adapter.