Signature's S, when over half order, has to be encoded differently

Reference implementation: https://github.com/bitcoin/bitcoin/blob/b7bba43a14a641b6b64bbf48357b2987c1b05800/src/key.cpp#L235-L238

ht @oleganza

Thoughts?
No argument that canonical signatures should be generated.  I guess I wasn't clear about that in my first comment where I said as much.  

This has been merged.  Thanks @yrashk for noticing the missing additional logic which was added after the original code was written.