Model CLSAG signing algorithm as state machine

[thomaseizinger]

To make adapter signatures possible, we need access to internal state of the signing algorithm. See 2fe0280 (#28).

Instead of returning this one constant from the signing function, we should re-model the loop inside the algorithm to a type-level state machine that makes execution of the algorithm safe and gives read-only access to internal state like this constant so that other protocols can be built on top of it safely.