Signature's S, when over half order, has to be encoded differently

Reference implementation: https://github.com/bitcoin/bitcoin/blob/b7bba43a14a641b6b64bbf48357b2987c1b05800/src/key.cpp#L235-L238

ht @oleganza

Thoughts?
I'll need to dig into this a bit, but it concerns me that without changing this the existing tests break.  Particularly since this test is an existing signature in the block chain.

I understand the intention of restricting the S value to < half order of the curve is to prevent a source of malleability and agree with the intent and that the case should be handled.  I suspect we might need a flag or different function though because existing signatures where not restricted in this manner.