Deterministic signatures

The OpenSSL-based deterministic signing implementation is likely very temporary, as we may switch to libsecp256k1 for signing soon (#5220), but it allows testing. The signatures generated by the OpenSSL and libsecp256k1 based implementations should be identical, so the test cases are already useful.

Yup, that's possible. OpenSSL has OPENSSL_cleanse() for that, which we could use too (but I would prefer crypto to not depend on OpenSSL...).

Ideally, I think we use belt-and-suspenders and let every layer do as much as it can to avoid this sort of leakage (which can't be 100% avoided anyway, unless you only ever let assembly code touch the confidential data).