`Group::try_from_rng()` is not supposed to allow identity points

[daxpedda]

The documentation of Group::try_from_rng() reads as following:

Returns an element chosen uniformly at random from the non-identity elements of this group.

However, we currently, quite intentionally, do allow identity elements here. For non-identity elements we have NonIdentity::random().

I'm not sure how we should address this, but at a minimum I think we should add some explicit documentation to these trait implementations.

[tarcieri]

The new implementation in at least primeorder and k256 in #1344 samples from affine points, and on those curves there is not an affine representation for the identity (i.e. it's the point at infinity). So there's no issue there.

However it seems this is an issue with ed448-goldilocks, where the identity has the affine representation (0,1), and it seems like the implementation in #1344 could potentially (with vanishing probability) sample the identity.

I think the solution there is to just reject the identity point in try_from_rng.

[daxpedda]

Right, I will go ahead and make a PR then.