Fixes off-by-one error in rng.js

Line 15 was an off-by-one error that tries to read an unused extra byte when n%8 == 0. Line 16 would have successfully read that byte (as 255) when x's high bit was 1, because the << operator converts to 32-bit signed and preserves the sign. Without this bugfix, zeroing rng_pool and then calling `for (var i=0; i<rng_psize/4; i++) {rng_seed_int(x, 32); }` would leave about 1/10 of bytes equal to 255.