crypto/internal/bigmod: switch to saturated limbs

[FiloSottile]

Package bigmod uses unsaturated 63-bit limbs because the tradition suggests that's faster, but that might be only true when targeting portable C. With access to add-with-carry instructions, Montgomery multiplication can be much faster with sautrated limbs, and we already have optimized assembly for that in math/big.

Switching bigmod to saturated limbs should allow us to reuse the math/big assembly cores, getting RSA performance back to Go 1.19 levels.

https://go.dev/cl/471259

[gopherbot]

Change https://go.dev/cl/471259 mentions this issue: crypto/internal/bigmod: switch to saturated limbs