Replace yanked secp256k1 beta

[ethicnology-agent]

Summary

• replace the yanked secp256k1 0.32 beta dependency with 0.33.1
• adapt MuSig nonce generation and key conversions to the 0.33 API
• update Cargo.lock to secp256k1-sys 0.14.1

This is the follow-up dependency migration described in #165.

Testing

• make cargo-build
• make cargo-clippy
• make wasm-build
• make wasm-clippy
• make wasm-test --headless --firefox (34 passed, 13 ignored)
• native regtest swap suite (13 passed)
• make wasm-regtest-test (7 passed)
• bindings: make check-python and make build-debug

The complete native test commands also reach two Liquid node tests that cannot start on Linux aarch64 because the elementsd download feature is enabled only on x86_64; the same failures reproduce on origin/trunk. The generated WASM consumer compiles on both the base and this branch, then both hit the same local arm64 wasm-opt bulk-memory validation failure.