As discussed in #687
This adds valgrind check to the repo.

It doesn't run on recovery+ecdh because of the time.
No openssl because of uninitialized mem.
I debated between with and without ASM, but decided with ASM because it
might be more fragile(?).

I wasn't sure if I should pass -DVALGRIND via CFLAGS or CPPFLAGS, it
seems like because this is only C then there shouldn't even be CPPFLAGS
but looks like we use CPPFLAGS in other places for the preprocessor
definitions.

If people are worried about the time it takes we can mark it as
allow_failure although I don't think it's a problem here because there's
only a handful of PRs and they're usually open for weeks.