NFC: bigint: Expand use of BoringSSL exponentiation test vectors.

Prepare to merge the rest of the not-yet-merged BoringSSL changes.

The recent refactoring of `PrivateExponent` lets us add a new test-only
constructor that can support a wider range of exponents. Also, there's
no reason to avoid test vectors with a base of zero. We do need to still
reject 0 as an *exponent* and too-small moduli.

Accordingly, merge in all the relevant test vectors from BoringSSL's
`bn_test.txt` into `bigint_elem_exp_consttime_tests.txt` as of
BoringSSL a8b1633, which is the last
commit of BoringSSL that has been merged into *ring* so far.

```
git diff \
  a8b1633:crypto/fipsmodule/bn/bn_tests.txt \
  src/arithmetic/bigint_elem_exp_consttime_tests.txt
```

src/arithmetic/bigint.rs

@@ -940,7 +940,7 @@ mod tests {
                 let base = consume_elem(test_case, "A", &m);
                 let e = {
                     let bytes = test_case.consume_bytes("E");
-                    PrivateExponent::from_be_bytes_padded(untrusted::Input::from(&bytes), &m)
+                    PrivateExponent::from_be_bytes_for_test_only(untrusted::Input::from(&bytes), &m)
                         .expect("valid exponent")
                 };
                 let base = into_encoded(base, &m);

src/arithmetic/bigint/private_exponent.rs

@@ -45,6 +45,23 @@ impl PrivateExponent {
         })
     }
 
+    #[cfg(test)]
+    pub fn from_be_bytes_for_test_only<M>(
+        input: untrusted::Input,
+        p: &Modulus<M>,
+    ) -> Result<Self, error::Unspecified> {
+        // Do exactly what `from_be_bytes_padded` does for any inputs it accepts.
+        if let r@Ok(_) = Self::from_be_bytes_padded(input, p) {
+            return r;
+        }
+
+        let dP = BoxedLimbs::<M>::positive_minimal_width_from_be_bytes(input)?;
+
+        Ok(Self {
+            limbs: dP.into_limbs(),
+        })
+    }
+
     #[inline]
     pub(super) fn limbs(&self) -> &[Limb] {
         &self.limbs