ed448-goldilocks: account for oddness in Scalar divisions

[daxpedda]

Taking what I learned from dalek-cryptography/curve25519-dalek#805 I applied this to ed448-goldilocks as well.

This is based on #1335 because the current check for torsion-freeness multiplies by the order, which breaks most proper assumptions made here.

[tarcieri]

@daxpedda why is this marked as draft?

Edit: aah, this I guess?

This is based on #1335 because the current check for torsion-freeness multiplies by the order, which breaks most proper assumptions made here.

[daxpedda]

It requires #1335.

The issue is that it messes with how scalar multiplication works, so the is_torsion_free() function, which multiplies a point with ORDER doesn't work anymore. Which is fine because ORDER isn't a valid scalar anyway. But #1335 implements a faster algorithm for is_torsion_free() which doesn't have the same problem.