Updated deps

[rozbb]

This requires a major version bump, as it is a breaking change. Because curve25519-dalek exposes its rand dependency, if another crate previously used an OsRng from v0.7 to generate a scalar (which e.g. ed25519-dalek does), it would not compile anymore. This seemed awkward to me but it looks like merlin does this too.

Notes on dependency updates:

• byteorder = "1" is the line that's used in byteorder's own README
• subtle is semantic-versioned (check me on this)
• I didn't switch fiat_crypto to 0.1 because I have no idea how it's versioned. Thankfully it's bug-free by definition, so that's not an issue >.>

[paolobarbolini]

I guess this PR should target the release/4.0 branch

[rozbb]

Resolved in release/4.0 branch