Enforce low-S signature verification

[mamonet]

Signature verification now rejects high-S signatures (BIP-62). Added normalize_low_s() and is_low_s() utility functions for both secp256k1 and secp256r1.
Verifiers will reject any ECDSA signature where s > n/2. This prevents signature malleability attacks since both (r, s) and (r, n - s) are mathematically valid for the same message.

If you have an existing high-S signature, call normalize_low_s() to convert it before verification.

Reference: BIP-62: Dealing with malleability

[mamonet]

I will look at the test failures tomorrow.

[rkeene]

It's not clear what the point of this change is.

[mamonet]

I think the reference I attached causes confusion in the description. Let me get back to this PR when I add support for secp256k1/secp256r1 in ledger device app, as it will add more context.