fix: reject identity keys and commitments in signatures

[AaronFeickert]

Signature verification currently allows identity elements:

• SchnorrSignature allows an identity public key
• CommitmentSignature allows an identity commitment
• CommitmentAndPublicKeySignature allows both

This doesn't strictly break soundness, but does remove message binding. While it shouldn't be problematic for unforgeability, it's a case that shouldn't arise from an honest signer and is easy to check for.

This PR fails signature verification if such an identity element is provided, and adds tests for each case. It does not return an error if the corresponding identity elements are provided by the signer, since this precludes useful partial signature operations.

[AaronFeickert]

It should be manually checked that each test fails if the corresponding verification check is disabled, which confirms that each signature is otherwise valid.