make sgn0 definition per-suite ; improve descriptions of sgn0 and sqrt functions

[kwantam]

This patch does three (roughly) related things:

1. It defines two variants of sgn0, "little endian" (LE) and "big endian" (BE).

• LE is a generalization of IEEE P1363a-2004 Section 5.5.6.1.1, ANSI X9.62-1998, Section 4.2.1, and SEC 1 Section 2.3.3. (All three of these use the same notion of sign: the value of the least significant bit.)

  This is the notion of sign used by most widely-deployed curves. For example, it's the one specified in RFC 8032 (Sections 5.1.3 and 5.2.3) and the one used in TLS (per RFC 4492, Section 5.1.2).

• BE is equivalent to the method given in IEEE P1363a-2004, Section 5.5.6.1.2.

  This is the form used by BLS12-381, and is the same as what we used to call sgn0.

2. It adds a sgn0 parameter to each suite that specifies which sgn0 function to use. All suites use sgn0_le except BLS12-381, which corresponds with widely-used notions of sign for each curve.

3. It clarifies the sqrt functions and gives a constant-time version of Tonelli-Shanks (which works for any p) due to Sean Bowe, Jack Grigg, Eirik Ogilvie-Wigley, and Michael Scott. It also moves these to the appendix, since we treat sqrt as non-normative (in particular, we don't care about how implementors compute the sign).

[kwantam]

(Rebased on new master)

[kwantam]

Rebased again. Phew!