Try to not leave secret data on the stack or heap.

This makes a basic effort and has not been audited.
Doesn't appear to have a measurable performance impact on bench.

It also adds a secp256k1_num_free to secp256k1_ecdsa_pubkey_create.
At the end of the loop its effectively the least significant few bits of the scalar we're multiplying by.  Your call, considering the probability that this assignment just gets optimized out, maybe its not worth the slight uglification of the loop.  (Though we could later change these to call a clean function on &bits, to at least avoid the optimization)

An alternative approach to these changes would be to figure out our peak stack usage and have the entrypoints that handle secret data call the interior function, then call a function that zeros that much stack.