Private key recovery via invalid curve point in github.com/ecies/go/v2

An attacker may be able to recover private keys due to a bug in the ECDH function.

The library does not check whether the provided public key is on the curve, which means that an attacker can create a public key that is not on the curve and use it to recover the private key.

A workaround is to manually check that the public key is valid by calling the IsOnCurve function from the secp256k1 libraries.