Make ECDSA.recover revert on error.

[nventuro]

Fixes #1978.

ECDSA.recover used to return the 0 address on error. This PR changes its behavior to the following:

1. it reverts if the signature size is incorrect
2. it reverts if the signature is malleable (non-unique)
3. it reverts if the signature is invalid (it recovers to the zero address)

I believe 1. and 2. are useful for debugging and error diagnosing, but I'm unsure about whether we should have 3. The scenario feels different from a situation where a signer was recovered, but it was not the one the system expected to warrant special handling.

I'll update the changelog with the changes once we decide whether or not we want to include 3.

[frangio]

I would argue that it is a different scenario because the address zero is not random. In all other cases you can essentially consider the result of recover to be "random", or at least not such that an attacker can choose the specific result. On the other hand it's quite easy to generate a signature that would recover to the address zero. With this argument I would revert to be on the safe side.

[nventuro]

I agree with that reasoning, yes. Thank you!