Return edwards::Point from sapling_ka_agree

This matches how sapling_ka_agree and kdf_sapling are defined in the
protocol spec. kdf_sapling also now takes ownership of dhsecret to
discourage use of the sapling_ka_agree output elsewhere.

librustzcash/src/rustzcash.rs

@@ -541,7 +541,7 @@ pub extern "system" fn librustzcash_sapling_ka_agree(
 
     // Produce result
     let result = unsafe { &mut *result };
-    result.copy_from_slice(&ka);
+    ka.write(&mut result[..]).expect("length is not 32 bytes");
 
     true
 }