Signature's S, when over half order, has to be encoded differently

Reference implementation: https://github.com/bitcoin/bitcoin/blob/b7bba43a14a641b6b64bbf48357b2987c1b05800/src/key.cpp#L235-L238

ht @oleganza

Thoughts?
I wonder if instead always allocating a new variable this should be done in the compare.  That way an allocation is avoided unless absolutely needed.  Like so:

```Go
sigS := sig.S
if sigS.Cmp(halforder) == 1 {
	// Only allocate a new copy as needed.
	sigS = new(big.Int).Sub(order, sigS)
}
```