Add edwards25519 (Ed25519) basepoint multiplication

This is very similar to the core of curve25519_x25519base, but
without the post-translation to the curve25519 Montgomery form,
and not fixing by assumption any low or high bits of the scalar
but accepting an arbitrary 256-bit scalar as input (though
it is reduced modulo the basepoint order internally).

s2n-bignum original commit: awslabs/s2n-bignum@b365f8e