New API for primegen(), using PrimeCandidateSource.

The more features and options I add to PrimeCandidateSource, the more
cumbersome it will be to replicate each one in a command-line option
to the ultimate primegen() function. So I'm moving to an API in which
the client of primegen() constructs a PrimeCandidateSource themself,
and passes it in to primegen().

Also, changed the API for pcs_new() so that you don't have to pass
'firstbits' unless you really want to. The net effect is that even
though we've added flexibility, we've also simplified the call sites
of primegen() in the simple case: if you want a 1234-bit prime, you
just need to pass pcs_new(1234) as the argument to primegen, and
you're done.

The new declaration of primegen() lives in ssh_keygen.h, along with
all the types it depends on. So I've had to #include that header in a
few new files.

test/cryptsuite.py

@@ -904,7 +904,7 @@ class keygen(MyTestBase):
             self.assertTrue (lo <= addend + (limit-1) * factor < hi)
             self.assertFalse(lo <= addend +  limit    * factor < hi)
 
-        pcs = pcs_new(64, 1, 1)
+        pcs = pcs_new(64)
         check(pcs, 2**63, 2**64, [(2, 1)])
         pcs_require_residue(pcs, 3, 2)
         check(pcs, 2**63, 2**64, [(2, 1), (3, 2)])
@@ -918,7 +918,7 @@ class keygen(MyTestBase):
         # Now test-generate some actual values, and ensure they
         # satisfy all the congruences, and also avoid one residue mod
         # 5 that we told them to. Also, give a nontrivial range.
-        pcs = pcs_new(64, 0xAB, 8)
+        pcs = pcs_new_with_firstbits(64, 0xAB, 8)
         pcs_require_residue(pcs, 0x100, 0xCD)
         pcs_require_residue_1(pcs, 65537)
         pcs_avoid_residue_small(pcs, 5, 3)