Tweak precomputed table size for G
Add secp256k1_scalar_mul_shift_var
Avoid division when decomposing scalars

- In secp256k1_gej_split_exp, there are two divisions used. Since the denominator is a constant known at compile-time, each can be replaced by a multiplication followed by a right-shift (and rounding).
- Add the constants g1, g2 for this purpose and rewrite secp256k1_scalar_split_lambda_var accordingly.
- Remove secp256k1_num_div since no longer used

Rebased-by: Pieter Wuille
Convert lambda splitter to pure scalar code.

This enables the use of the endomorphism optimization without bignum.
Bugfix: b is restricted, not r
Merge pull request #129

35399e0 Bugfix: b is restricted, not r (Pieter Wuille)
Fix typo
Merge pull request #131

82f9254 Fix typo (Pieter Wuille)
Use constant-time conditional moves instead of byte slicing
Avoid undefined shift behaviour
Make scalar_add_bit test's overflow detection exact
Merge pull request #133

9048def Avoid undefined shift behaviour (Pieter Wuille)
Merge pull request #132

efb7d4b Use constant-time conditional moves instead of byte slicing (Pieter Wuille)
Merge pull request #127

c35ff1e Convert lambda splitter to pure scalar code. (Pieter Wuille)
cc604e9 Avoid division when decomposing scalars (Peter Dettman)
ff8746d Add secp256k1_scalar_mul_shift_var (Pieter Wuille)
Merge pull request #134

29ae131 Make scalar_add_bit test's overflow detection exact (Pieter Wuille)
Rewrite field assembly to match the C version
Convert YASM code into inline assembly
Make {mul,sqr}_inner use the same argument order as {mul,sqr}
Fix a memory leak and add a number of small tests.

This fixes a simple copy and paste induced memory leak for the ecdsa init.

The tests are mostly just improving coverage and aren't interesting.
Merge pull request #135

ee3eb4b Fix a memory leak and add a number of small tests. (Gregory Maxwell)