[crypto] Correct harmless arithmetic error in Weierstrass curve sizing

[crypto] Correct harmless arithmetic error in Weierstrass curve sizing

The calculation of the number of zero padding bits required to ensure
that relaxed Montgomery multiplication produces a result in the chosen
range is incorrect: the requirement is k=m^2 rather than k=m.

This makes no difference to the code: for both P-256 and P-384, adding
any zero padding bits will cause an extra big integer element to be
used.  This extra element provides 32 (or 64) zero padding bits, which
is many more than are required to ensure that relaxed Montgomery
multiplication produces a result in the chosen range.

Fix the calculation, and update the comments to match.

Signed-off-by: Michael Brown <mcb30@ipxe.org>