ec_mult.h: harden booth_encode().

This is a complement to 553ea28. The
information about 'wval >> sz' being a single bit is formally
deducible, so the compiler could emit the 'select' llvm bytecode.
It wasn't observed though, not then or now.

src/ec_mult.h

@@ -46,9 +46,10 @@ static limb_t get_wval_limb(const byte *d, size_t off, size_t bits)
 static limb_t booth_encode(limb_t wval, size_t sz)
 {
     limb_t mask = 0 - (wval >> sz);     /* "sign" bit -> mask */
+    launder(mask);
 
     wval = (wval + 1) >> 1;
-    wval = (wval & ~mask) | ((0-wval) & mask);
+    wval = (wval ^ mask) - mask;
 
     /* &0x1f, but <=0x10, is index in table, rest is extended "sign" bit */
     return wval;