silentpayments: add light client API

[theStack]

This PR extends the silentpayments module with API functions for prevouts_summary (de)serialization and output public key (k=0) creation, intended to be used by tweak indexers and light clients. Note that this functionality was originally introduced in the take 3 PR (#1698), but was then later intentionally removed again in take 4 (#1765, recently merged and released), in order to reduce the scope and lower the review burden.

The following 3 API functions are added:

• secp256k1_silentpayments_recipient_prevouts_summary_serialize: given a prevouts_summary object, create the corresponding 33-bytes or 65-bytes serialization
• secp256k1_silentpayments_recipient_prevouts_summary_parse: given a 33-byte or 65-byte prevouts_summary representation, create the corresponding prevouts_summary object
• secp256k1_silentpayments_recipient_create_output_pubkeys: given a prevouts_summary object, a recipients scan secret key and a list of spend public keys, create a list of corresponding x-only output public keys (one for each spend public key, each derived with k=0).

Tests, benchmarks and the example are extended accordingly.

[theStack]

Rebased on master (adapting to the _eckey_pubkey_... -> _ge_... serialize/parse renames #1915) and fixed the unintentional accepting of prevouts_summary deserialization if they are in hybrid pubkey format (i.e. 65 bytes with prefix bytes 0x06 or 0x07). This will be a bit simpler and more explicit if #1918 gets in and secp256k1_ge_parse{33,65} can be used, added a TODO comment accordingly.

[bitsagarob]

Tested ACK 0b1cde3

Exercised the new light client API against real chain data rather than constructed inputs: the 33-byte tweak a BlindBit Oracle v2 serves for a real 50,000 sat silent payment in mainnet block 965085, paid to a throwaway wallet whose scan key is published.

1. parse the 33-byte tweak the oracle serves
   ok
2. scan that transaction's one output
   found f420241ebdee9a956f88f6ea704b1e02871a64082f61489150222c3a33ee6038
   MATCHES the real 50,000 sat payment
3. round-trip: serialize the parsed summary back to 33 bytes
   in  023497fcdef5a9254be2e60e02a53bcede1e3d4ab67ed1928140a1d69438bb5678
   out 023497fcdef5a9254be2e60e02a53bcede1e3d4ab67ed1928140a1d69438bb5678
   identical
4. the 65-byte form should scan identically
   same payment found via 65-byte form
5. create_output_pubkeys, the filter-matching path, from the same tweak
   k=0 candidate f420241ebdee9a956f88f6ea704b1e02871a64082f61489150222c3a33ee6038
   equals the real output, so a filter would hit

Step 3: the 33-byte serialization is byte-identical to the deployed BlindBit wire format, so an index server can hand its bytes straight to _prevouts_summary_parse.

Tested with:
cmake -B build -DSECP256K1_ENABLE_MODULE_SILENTPAYMENTS=ON -DSECP256K1_BUILD_BENCHMARK=ON
cmake --build build -j8 && ctest --test-dir build — 223/223 passed
x86-64 Linux, gcc 13.3.0. ctime_tests needs valgrind headers I don't have here, unrelated to this PR.