RSA exponents are typically 3 or 65537, and public.

For those, we don't need to use conditional moves on the exponent,
and precomputing a lookup table is not worth it. So, save a few
cpu cycles and some memory for that common case.

For safety, make `powWithEncodedExponent()` constant-time by default,
and introduce a `powWithEncodedPublicExponent()` function for exponents
that are assumed to be public.

With `powWithEncodedPublicExponent()`, short (<= 36 bits) exponents
will take the fast path.