Add a missing bn_restore_invariant in RSA blinding code.

We were inventing a random number by starting with a long zero bignum
and then setting bits at random, which left an opportunity for the
result to be a non-normalised representation (with a leading zero
word) and hence fail an assertion in bignum_cmp.


git-svn-id: svn://svn.tartarus.org/sgt/putty@10147 cda61777-01e9-0310-a592-d414129be87e