Update edwards25519 fiat code from BoringSSL

Update edwards25519 fiat code from BoringSSL

Bring the SPAKE edwards25519_fiat.h up to date with BoringSSL commit
5813c2c10c73d800f1b0d890a7d74ff973abbffc.  This update adds value
barriers to the conditional move functions, to prevent clang
optimizations that would make them not constant-time.

Update the path reference comments in edwards25519.c and
edwards25519_tables.h, but do not update the code as the upstream
license has changed.