Support extendable backup flag

[andrewkozlik]

Related to spec update satoshilabs/slips#1724.

Note that we need to get this merged and released in order for the firmware device tests to pass on the corresponding firmware branch https://github.com/trezor/trezor-firmware/compare/andrewkozlik/slip39.

[matejcik]

functionality LGTM.

i added a bunch of commits fixing tiny problems. please review 706934d in particular which is the only questionable one -- it seemed cleaner to pass the full customization string into RS1024 from the outside. but I'm not attached to that solution, i'll remove that commit if you dislike it.

[andrewkozlik]

a1cb726 Updated a comment.

The customization string shamir_extendable is not used in the PBKDF2 salt. We wanted to completely decouple the decryption method from the sharing method and the share representation, i.e. not use the customization string from the checksums in decryption, and I believe avoiding the mention of shamir in the PBKDF2 salt is right, because it allows us to cleanly update backups even to different secret sharing schemes in the future if we want.

[andrewkozlik]

706934d breaks generate_vectors.py, line 66:

mnemonic = wordlist.mnemonic_from_indices(
    indices + rs1024.create_checksum(indices, False)
)

[andrewkozlik]

Fixed in 38964c0. LGTM now. @matejcik please recheck and then we can squash and merge.

[matejcik]

LGTM, go ahead