docs: added comments for the splitting of S in eddsa

[ThomasPiellard]

In EdDSA, the S scalar in the signature is now split in 2, to prevent overflowing --> S should NOT be reduced modulo r, the size of the snark field. So if n is the bit length of r, S is split in S1, S2 such that S = 2^(n/2)S1+S2, so S1 and S2 are the digits of S in basis 2^(n/2).

Breaking changes

The signature struct is now

type Signature struct {
	R      twistededwards.Point
	S1, S2 frontend.Variable // --> instead of: S frontend.Variable
}

Examples of how to properly split S given a signature is in std/signature/eddsa/eddsa_test.go. If r is n-bits long, splitting S amounts to take the first n/2 bits of the part of the signature corresponding to S for S1, and the last n/2 bits of the part of the signature corresponding to S for S2 (the signature is a byte slice point||S, the first n-bits chunk is the compressed point, the last bits are S).

[gbotrel]

See also #88