Fix undefined behavior in unsigned-to-signed conversion
Fix undefined behavior in unsigned-to-signed conversion

The code assumed that `int x = - (unsigned) u` with 0 <= u < INT_MAX
sets `x` to the negative of u, but actually this calculates
(UINT_MAX - u) and then converts this value to int, which overflows.
Cast to int before applying the unary minus operator to guarantee the
desired behavior.

NXPmicro/mbedtls,ARMmbed/mbedtls,Mbed-TLS/mbedtls,Mbed-TLS/mbedtls,NXPmicro/mbedtls,ARMmbed/mbedtls,Mbed-TLS/mbedtls,ARMmbed/mbedtls,NXPmicro/mbedtls,ARMmbed/mbedtls,NXPmicro/mbedtls,Mbed-TLS/mbedtls