elliptic-curve: fields with lazy reduction

首先审查链接的 curve25519-dalek PR 787 和 813，以及此处描述的 LazyField、EagerField 和 LazyFieldWithCapacity 提案。确定这些 traits 应归属于 ff、primefield、elliptic-curve，还是新的 RustCrypto crate；在就 upstream 位置达成一致并完成设计审查后，任务才算完成。

When exposing FieldElement from curve25519-dalek (https://github.com/dalek-cryptography/curve25519-dalek/pull/787), it was noted how curve25519-dalek only reduces its field element occasionally and how the proposed PR fails to model that in the name of safety. https://github.com/dalek-cryptography/curve25519-dalek/pull/813 resolved this by introducing LazyField, a trait for a field which only occasionally performs reductions, using typenum to track capacity consumption via the Rust type system. This allows reducing when reductions occur, while ensuring operations remain well-defined.

In practice, for performance, there's no reason not to use LazyFieldWithCapacity<U1>. Any existing field can be wrapped with EagerField to achieve API compatibility. Any field with any capacity is benefited. It is suboptimal for fields with even greater capacity, yet those would already lose their benefit if Field alone was used (which would mandate performing a reduction after every single operation to remain well-defined in a constant-time context).

Ideally, these traits do not permanently reside in curve25519-dalek yet are upstreamed somewhere they can achieve wider adoption from. This would mean ff(which so far hasn't adopted typenum) or somewhere in the RustCrypto ecosystem (primefield, elliptic-curve, or a new crate). I wanted to create this issue to discuss the traits and where would be optimal for them. I'd also like to invite review over them. While I believe my prototype accomplishes its goals, and is fine to be published under curve25519_dalek::hazmat for now to accomplish the goals of finally exposing the curve25519_dalek FieldElement type, I also believe they could benefit from further review and fine-tuning.