Fix timing leak in BN_from_montgomery_word.
Fix timing leak in BN_from_montgomery_word.

BN_from_montgomery_word doesn't have a constant memory access pattern.
Replace the pointer trick with a constant-time select. There is, of
course, still the bn_correct_top leak pervasive in BIGNUM itself.

See also https://boringssl-review.googlesource.com/22904 from BoringSSL.

Reviewed-by: Andy Polyakov <015edf36635e030d5e009e08808a59984e629740@openssl.org>
Reviewed-by: Kurt Roeckx <bb87b47479d83cec3c76132206933257ded727b2@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/5228)

openssl/openssl,openssl/openssl,openssl/openssl,openssl/openssl,openssl/openssl,openssl/openssl