BIP352: be explicit for the input_hash corner case

While this is statistically improbable, e.g., we don't yet know of a hash preimage that results in an output = 0 or greater than the curve order, we still want to be explicit on how to handle this (same as we do for the tweaks themselves).

Specification