crypto/internal/fips140/bigmod: explicitly clear expanded limbs on reset

Russ Cox noticed that reset was clearing limbs up to the *previous* Nat
size, not up to the new size, because clear(x.limbs) was happening
before the x.limbs[:n] reslice.

That's potentially a severe issue, because it may leave garbage in
x.limbs[len(x.limbs):n] if n < cap(x.limbs).

We were saved by an accidental invariant caused by the bug itself,
though: x.limbs[len(x.limbs):cap(x.limbs)] are always zero.

reset was always clearing all exposed (and hence potentially non-zero)
limbs before shrinking the Nat, and the only other function that could
shrink the Nat was trim, which only trims zero limbs.

Near miss.

Preserve the accidental invariant in the fix, because memclr is cheap
and it just proved it can save us from potential mistakes.

Change-Id: I6a6a4656a77735d8e8d520c699c4d85dd33ce497
Reviewed-on: https://go-review.googlesource.com/c/go/+/655056
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Junyang Shao <shaojunyang@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>

src/crypto/internal/fips140/bigmod/nat.go

@@ -96,7 +96,8 @@ func (x *Nat) reset(n int) *Nat {
 		x.limbs = make([]uint, n)
 		return x
 	}
-	clear(x.limbs)
+	// Clear both the returned limbs and the previously used ones.
+	clear(x.limbs[:max(n, len(x.limbs))])
 	x.limbs = x.limbs[:n]
 	return x
 }