Use 'low S' as malleability breaker rather than 'even S'

As we don't have any releases enforcing this yet, and no others that have picked it up, we can change this without harm. It has the advantage of on average decreasing signatures by 0.5 byte, and avoiding DER padding problems.