Add a random scalar generation that is uniformly distributed

[moCello]

Summary

The current implementation of a random scalar wraps a randomly generated bit-field around the modulus to ensure the scalar is valid. This approach makes us hit some scalars more than others.
Another approach would be to zero out the highest two bits but that in turn results in missing some scalars entirely.
Ideally we want to have a random scalar generation that is uniformly distributed.

Possible Solution

Use rejection sampling. This makes the random scalar generation not constant time but that shouldn't be a problem since no information on the scalar can be gained by analyzing the time it took to generate it.