Rust bindings: expose safe blst_scalar constructors about blst HOT 2 OPEN

It seems that verify_multiple_aggregate_signatures could accept something less "rigid" than blst_scalar. At least blst_scalar is quite wasteful, because rand_bits would be significantly smaller than blst_scalar bit width, right? It might take some extra interfaces, but it might be worthwhile to arrange. Alternatively one can argue that just a sequence of random bytes cast to limbs would do [as input to the subroutine in question]. Indeed, on little-endian platform lendian->limbs conversion is effectively a no-op anyway, and on big-endian "randomness" would be "applied" in reverse byte order, which is arguably as random.

This is not to say that it would inappropriate to wrap unsafe functions! Just that it seems to be an extra angle to the problem.

from blst.

on big-endian "randomness" would be "applied" in reverse byte order, which is arguably as random.

Just in case, this is naturally assuming that if rand_bits is not divisible by limb's bit-witdth, the byte sequence is not conditioned accordingly. I mean that no byte is masked with few-bit mask.

from blst.