Properly handle BIP-340 Schnorr signatures with or without BIP-341 taproot tweaked keys

[xoloki]

In the early days of sBTC-Alpha, we had no idea how Taproot worked. I started by implementing BIP-340, only to discover that I really needed to implement BIP-341 as well to get tweaked public keys. At that point there was no way to do BIP-340 alone.

We discovered recently that TapScript public key spends need to use BIP-340 without BIP-341, since the whole point of tweaking the keys is to prevent hidden script spends, and we're already inside the script at that point. So this change enables that, from the low level Signer/Aggregator code all the way up to the network packets and state machines.

[djordon]

I still have more to look at, but figured I'd submit what I've already seen. So far, looks good, these are all minor suggestions.

[djordon]

This largely looks good. But I think we should add a bit more documentation for the sign functions so that we can easily verify that things are computed correctly. I wasn't entirely sure which procedures I should be following for some of the sign functions, so I also want this so that I can give a more meaningful review.

I know we have the tests but I still think we should have the documentation, plus tests can be "faulty". Not saying that these are, they seem fine.

[djordon]

Looks good.

As a follow-up we should do #24. We can pull in the setup code from the sBTC repo to make that all easy. That way we can be very confident that this works.