This provides a minor optimisation for ed25519 signature verification, when used
without the -DED25519_COMPAT feature, to strictly check for a fully reduced
scalar, `s`, component in variable time by first checking that the most
significant *four* bits are unset, and only if any of them are set proceed to
the `sc25519_is_canonical` check which performs the full reduction. This should
result in succeeding fast for the check on roughly half of all well-formed,
canonicalised signatures.
This is safely backwards compatible with the previous implementation
of strict checking for signature scalars.
