[3.6] Reduce performance regression in RSA public operations

[mpg]

Description

Fix #9232 - partially, the low-hanging fruits (also those that don't make the code size go up by too much).

Status: work in progress.

TODO:

• [ ] measure code size
• [ ] measure perf on other platforms
• [ ] currently the window size is based on the limbsize of E, should it use the actual bitsize instead when E is public?
• [ ] decide on API
• [ ] propagate to RSA functions

PR checklist

• [ ] changelog provided, or not required
• [ ] 3.6 backport this is it, but needs forward-porting
• [x] 2.28 backport not required
• [ ] tests provided, or not required

[mpg]

Initial performance measurements on my laptop (64-bit Intel):

3.6.0

1024/1024-bit exp_mod, cold r: 0.961081 ms
1024/1024-bit exp_mod,  hot r: 1.050500 ms
  17/1024-bit exp_mod, cold r: 0.100309 ms
  17/1024-bit exp_mod,  hot r: 0.177438 ms

This PR

1024/1024-bit exp_mod, cold r: 1.070629 ms
1024/1024-bit exp_mod,  hot r: 1.062271 ms
  17/1024-bit exp_mod, cold r: 0.034083 ms
  17/1024-bit exp_mod,  hot r: 0.027739 ms

3.5.1

1024/1024-bit exp_mod, cold r: 1.071714 ms
1024/1024-bit exp_mod,  hot r: 1.083624 ms
  17/1024-bit exp_mod, cold r: 0.022744 ms
  17/1024-bit exp_mod,  hot r: 0.016366 ms