Expose EC point arithmetic and add bip352_encode for Silent Payments

[macgyver13]

BIP-352 (Silent Payments) and BIP-374 (DLEQ proofs) need generic EC arithmetic
that the current API cannot express.

The existing keypair.ecdh_multiply() returns sha256(x || y) of the shared
point. BIP-352 needs the point, not a digest, because the ECDH share is
multiplied again by input_hash before it is hashed.

BIP-352 also uses point addition to sum input pubkeys into A_sum, combine per-input
ECDH shares, and add a label tweak to the spend key.

generator() and curve_order*() are exposed as constants because the Python
side references them on nearly every operation. Deriving G through
keypair(1).pubkey() per call is wasteful, and curve_order_int() skips an
int.from_bytes() on each scalar reduction.

bip352_encode follows BIP-352's bech32m + version-byte layout for scan_key || spend_key
(65 or 66 bytes depending on whether a scan pubkey or a watch-only scan privkey is passed).

Raises BECH32_MAX_LEN from bech32's 90-char cap to 128 to fit the silent payments address's
~117 chars, and re-derives the two pre-existing bech32 encode buffers from that same constant so
they don't drift.

Used by the Coldcard firmware's shared/silentpayments.py (BIP-352) and shared/dleq.py
(BIP-374) PR 587.

Note to reviewers:

cd external/libngu/ngu
../../../unix/coldcard-mpy ngu_tests/run.py
...
PASS - test_random
PASS - test_codecs_gen.py
PASS - test_hash_gen.py
PASS - test_hdnode
PASS - test_hdnode_gen.py
PASS - test_k1
PASS - test_k1_gen.py
PASS - test_bip39
PASS - test_bip32

[scgbckbone]

• Replace vstr output and mp_obj_new_str_from_vstr(...) with a byte buffer returned via mp_obj_new_bytes()

uint8_t output[33];
size_t outlen = sizeof(output);
secp256k1_ec_pubkey_serialize(..., output, &outlen, ...);
return mp_obj_new_bytes(output, outlen);

• Replace STATIC with standard lowercase static.

we will eventually migrate to newer mpy (v1.17 -> v1.28) and above is deprecated