Signature's S, when over half order, has to be encoded differently

Reference implementation: https://github.com/bitcoin/bitcoin/blob/b7bba43a14a641b6b64bbf48357b2987c1b05800/src/key.cpp#L235-L238

ht @oleganza

Thoughts?
This is a constant value.  Rather than recreating it for every serialize, it would be better as a variable declared at the top of the file with an appropriate comment.  Also, please use camel case to match the existing code style for the variable name

```diff
diff --git a/signature.go b/signature.go
index ef23489..7e35c94 100644
--- a/signature.go
+++ b/signature.go
@@ -19,6 +19,10 @@ var (
        errExcessivelyPaddedValue = errors.New("value is excessively padded")
 )

+// s256HalfOrder is the secp256k1 curve order / 2.  It is used when serializing
+// signatures to enforce low S values.
+var s256HalfOrder = big.NewInt(0).Rsh(S256().N, 1)
+
 // Signature is a type representing an ecdsa signature.
 type Signature struct {
        R *big.Int
```