[API BREAK] Use rfc6979 as default nonce-generation function

Builds on top of #162, but also provides a safe default when not specifying a nonce generation function explicitly.

This means incorporation of a SHA256 / HMAC / RFC6979 implementation inside libsecp256k1. It's an increase of around 10 kilobytes of object size on x86_64, which I think is acceptable, despite it being likely code duplication (as callers already need to compute hashes too).