Make secp256k1_scalar_b32 detect overflow in scalar_low

Summary:
This is a partial backport of secp256k1 PR808 : https://github.com/bitcoin-core/secp256k1/pull/808/commits/8bcd78cd791fd9209d72d6bce455c8d3cf2c0249

Depends on D7655

Test Plan:

ninja check-secp256k1

Reviewers: #bitcoin_abc, Fabien

Reviewed By: #bitcoin_abc, Fabien

Differential Revision: https://reviews.bitcoinabc.org/D7656