math/, pub/: Take a more consistent approach to prime-generation failures.

  * Don't have `strongprime_setup' assert just because the requested
    size is too small.

  * Fix `strongprime' itself, so that it leaves its destination in a
    predictable state (specifically, it's unmolested) if it fails.

  * Remove the retry loops from `bbs_gen' and `rsa_gen'.  Now,
    downstream failures are consistently propagated.