crypto/rsa: fix infinite loop in GenerateMultiPrimeKey for large nprimes

The heuristics for BitLen of a product of randomly generated primes
are wrong, and the generated candidates never match the required
size for nprimes > 10. This corner case is not expected to be used in
practice.

R=agl
CC=golang-dev
https://codereview.appspot.com/7397052