Optimize doubling: secp256k1 has no y=0 point
Explain why no y=0 check is necessary for doubling

Explanation suggested by Greg Maxwell.
Do signature recovery/verification with 4 possible recid case
Add secp256k1_scalar_add_bit
Generalize secp256k1_scalar_get_bits
Switch wnaf splitting from num-based to scalar-based
Make test_point_times_order test meaningful again

As wnaf splitting is scalar based, multiplying with the order directly
would be reduced to multiplication with zero before even converting to
wnaf.
Add secp256k1_scalar_inverse_var which delegates to GMP
Add scalar splitting functions

Which currently delegate to the lambda-splitter in group.
Switch all EC/ECDSA logic from num to scalar
Move lambda-splitting code to scalar.

It's not really an operation on group elements.
Remove unused num functions
Make constant initializers independent from num
Make num optional
Optimize verification: avoid field inverse

Suggested by Greg Maxwell.