Previous code allocated an array on the stack of mlen bytes, but
it should be possible to also sign heap-space messages. By relying
on the fact that sm and m fit the message + signature, we move
the message so that 4*n bytes of prefix can be added.

The variable sm should contain the signature and the message,
not the message and the signature (i.e. the order is crucial).

This makes it easier to mix and match with other implementations
for compatibility testing.