btcutil: zero range-check scalar before returning from DecodeWIF

Wipe the secp256k1 scalar used for the [1, N-1] range validation as
soon as DecodeWIF returns, so the decoded private key value does not
linger in this local after use. Addresses review feedback on #2545.

Author: Lrifton92

btcutil/wif.go

@@ -127,6 +127,7 @@ func DecodeWIF(wif string) (*WIF, error) {
 	// the one actually encoded in the WIF (or the all-zero key) without
 	// reporting an error.
 	var keyScalar btcec.ModNScalar
+	defer keyScalar.Zero()
 	if overflow := keyScalar.SetByteSlice(privKeyBytes); overflow ||
 		keyScalar.IsZero() {