Fix RFC6979 generation of k.
Fix RFC6979 generation of k.

The standard says:
step h:
  Set T to the empty sequence.
  while tlen < qlen
    V = HMAC_K(V)
    T = T || V
  k = bits2int(T)

in this case (HMAC-SHA256, qlen=256bit) this simplifies to
  V = HMAC_K(V)
  T = V
  k = bits2int(T)
and T can be omitted.

The old code (wrong) did:
  T = HMAC_K(V)
  k = bits2int(T)
Note that V will only be used again if the first k is out of range.
Thus, the old code produced the right result with a very high probability.

trezor/trezor-crypto,runn1ng/trezor-crypto,jhoenicke/trezor-crypto,jhoenicke/trezor-crypto,jhoenicke/trezor-crypto,romanz/trezor-crypto,trezor/trezor-crypto,jhoenicke/trezor-crypto,romanz/trezor-crypto,trezor/trezor-crypto,01BTC10/trezor-crypto,romanz/trezor-crypto,01BTC10/trezor-crypto,runn1ng/trezor-crypto,trezor/trezor-crypto,trezor/trezor-crypto,runn1ng/trezor-crypto,runn1ng/trezor-crypto,jhoenicke/trezor-crypto,01BTC10/trezor-crypto,romanz/trezor-crypto,runn1ng/trezor-crypto,romanz/trezor-crypto