NonZeroScalar for mul_tweak

[Kixunil]

We can statically rule out invalid tweaks by having NonZeroScalar and have it constructible from ThirtyTwoBitHash. Unfortunately we can't do layout optimizations but even if we could we would have to drop ThirtyTwoBitHash or make it unsafe.

See also LLFourn/secp256kfun#144

[apoelstra]

It is not just zero that we have to avoid tweaking by -- it is also scalars that exceed the group order. We have a type that encodes these invariants -- SecretKey -- which we could use for tweak_add and tweak_mul, but that still wouldn't get rid of the error return, because for tweak_add we also require that the tweak not be the additive inverse of the original key.

[Kixunil]

Scalar already guarantees being within curve order so presumable NonZeroScalar would guarantee it as well.

SecretKey

Yeah, it is the same when it comes to allowed values but it also indicates it's secret while scalars may not be.

tweak_add

That one stays as-is unfortunately.