Update edwards25519 code from BoringSSL

Update edwards25519 code from BoringSSL

Bring the SPAKE edwards25519.c code up to date with BoringSSL, adding
edwards25519_fiat.h to contain the Fiat-generated code which BoringSSL
has split out.  The relevant BoringSSL commits are:

  302bb3964ad8cc4fb8540ee4783a936c5515605d
  5590c715e26790d9b60384e1ac092529a19208af
  32e59d2d3264e4e104b355ef73663b8b79ac4093
  899835fad40f50f4c29bf7042b415eb72ad0e7d7
  9847cdd785abae6313412fc5a824b938bef6ba98

The updated code avoids undefined signed left-shift behavior (not a
problem in practice, so far) and compiles to faster code with gcc on
platforms where the 64-bit code cannot be used.