Add secp256k1_verify/secp256k1_recover_pubkey tests from Project Wycheproof

[webmaster128]

The goal here is to increase our test coverage of the secp256k1 verifier in preparation for the upcoming secp256r1 verifier.

More than 2k additional test, all passing without touching the implementation 🎉

---

Update: the first 10 commits here are just more tests. The last one then uses the gained confidence and adapt the pubkey recovers as discussed in RustCrypto/elliptic-curves#991 (comment).

---

Update 2: removed the fix and split it into #2014 because I don't like having it all together. This PR now purely adds tests, but for both secp256k1_verify and secp256k1_recover_pubkey.

[chipshort]

Good stuff!

[chipshort]

Just wondering, wouldn't it have been easier to use a ready-made crate like der for decoding the integers, with tag and everything?

[webmaster128]

Good question. I think the issue is that you the test vectors make additional requirements because by nature, DER is non-deterministic, allowing signature malleability (i.e. different representations of the same signature) which allows creating multiple tx hashes from a single signature. As far as I can tell, all crypto use cases implement this themselves.

I already added the DER question here: #2001, so let's postpone it. For now DER only comes in through Project Wycheproof and is not something relevant for our APIs. In the Ethereum and Cosmos world DER is not used at all. Bitcoin is getting rid of it slowly.