k256: reject signatures which aren't low-S normalized

k256: reject signatures which aren't low-S normalized #2171