Draft BBS implementation

[chris-wood]

Starting as a draft to collect early feedback. I've not checked against all of the test vectors in the draft, but most of the positive cases. I'm interested in feedback on the API at this point. Function internals will be improved in the future PR. Please ignore all of the random comments and notes for myself -- a lot of them are notes to send feedback to the CFRG draft for improvement.

This branch is necessary to support prototype work for a Privacy Pass token type built on BBS.

cc @wbl, @tplooker