curve25519: Add arbitrary integer multiplication with `MontgomeryPoint::mul_bits_be`

[rozbb]

There is occasionally a need to multiply a non-prime-order Montgomery point by an integer. There's currently no way to do this, since our only methods are multiplication by Scalar (doesn't make sense in the non-prime-order case), and MontgomeryPoint::mul_base_clamped clamps the integer before multiplying.

So we define MontgomeryPoint::mul_bits_be, gated behind hazmat, which takes a big-endian representation of an integer and multiplies the point by that integer.

cc @elichai

[rozbb]

@tarcieri ready for review. One thing I wanna make sure of personally is that this hasn't strayed too far from Alg 8 of CS17