[otbn] Fix some issues in modexp assembly
[otbn] Fix some issues in modexp assembly

The modexp assembly doesn't currently run on the new simulator. Some
problems are simulator-related, others are bugs in the code. I'm still
going through all of them, but here are two fixes which are clearly
wrong in the assembly.

* LW expects offsets in bytes, not in 32b words.
* In contrast to dcrypto1, routines need to end with an explicit ECALL
  instruction.

Signed-off-by: Philipp Wagner <5a4b10454c30419e54a1570be358a516ff84bb63@lowrisc.org>

lowRISC/opentitan,lowRISC/opentitan,lowRISC/opentitan,lowRISC/opentitan,lowRISC/opentitan,lowRISC/opentitan