musig: invalidate output if pubnonce/aggnonce parsing fails #1991

Every other parse function in the library (ec_pubkey_parse,
xonly_pubkey_parse, the ECDSA signature parsers,
silentpayments_recipient_label_parse and musig_partial_sig_parse)
clears its output object before parsing, so that a failed parse leaves
an object that is rejected when it is used later.

musig_pubnonce_parse and musig_aggnonce_parse return 0 but leave the
output untouched instead. If the object was not initialized, a later
load reads uninitialized memory. If it holds an earlier nonce, for
example when a coordinator parses incoming nonces into a reused array,
that stale nonce stays valid and is accepted by nonce_agg and
nonce_process without any error.

Clear the output right after checking that it is non-NULL, as
ec_pubkey_parse and xonly_pubkey_parse do, so that it is also cleared
if in66 is NULL.

Parse a valid nonce into an object, then parse an invalid encoding into
the same object, and check that the object is cleared and rejected by
serialize and by nonce_agg (for a pubnonce) or nonce_process (for an
aggnonce). Also check the case where in66 is NULL.

An all-zero encoding is a valid aggnonce (both points at infinity), so
the aggnonce test uses an invalid prefix byte instead.

These checks fail without the previous commit.

partial_sig_parse cleared its output only after both ARG_CHECKs, so a
NULL in32 left a previously parsed signature in place. Clear it right
after checking sig, as the nonce parsers now do. Adjust the NULL in32
test to use a temporary object and check that it is cleared.

xonly_pubkey_parse documents that its output is set to an invalid value
if parsing fails. The musig parse functions now all behave this way, so
document it for pubnonce_parse, aggnonce_parse and partial_sig_parse as
well.