Optimize doubling: secp256k1 has no y=0 point
Explain why no y=0 check is necessary for doubling

Explanation suggested by Greg Maxwell.
Add secp256k1_scalar_add_bit
Generalize secp256k1_scalar_get_bits
Switch wnaf splitting from num-based to scalar-based
Make test_point_times_order test meaningful again

As wnaf splitting is scalar based, multiplying with the order directly
would be reduced to multiplication with zero before even converting to
wnaf.
Add secp256k1_scalar_inverse_var which delegates to GMP
Add scalar splitting functions

Which currently delegate to the lambda-splitter in group.
Switch all EC/ECDSA logic from num to scalar
Move lambda-splitting code to scalar.

It's not really an operation on group elements.
Remove unused num functions
Merge pull request #117

c76be9e Remove unused num functions (Pieter Wuille)
4285a98 Move lambda-splitting code to scalar. (Pieter Wuille)
f24041d Switch all EC/ECDSA logic from num to scalar (Pieter Wuille)
6794be6 Add scalar splitting functions (Pieter Wuille)
d1502eb Add secp256k1_scalar_inverse_var which delegates to GMP (Pieter Wuille)
b5c9ee7 Make test_point_times_order test meaningful again (Pieter Wuille)
0b73059 Switch wnaf splitting from num-based to scalar-based (Pieter Wuille)
1e6c77c Generalize secp256k1_scalar_get_bits (Pieter Wuille)
5213207 Add secp256k1_scalar_add_bit (Pieter Wuille)
Merge pull request #120

e3d692f Explain why no y=0 check is necessary for doubling (Pieter Wuille)
f7dc1c6 Optimize doubling: secp256k1 has no y=0 point (Pieter Wuille)
Require that r and b are different for field multiplication.

Suggested by Peter Dettman, this prepares for slightly faster muitiplication
which writes results immediately to r before finishing reading b.
Make secp256k1_fe_mul_inner use the r != property

Suggested by Peter Dettman.
Rewrite field assembly to match the C version