A tighter bound on sqrt() iterations

[fjarri]

Currently, as prescribed by Hast, "Note on computation of integer square roots" (https://github.com/RustCrypto/crypto-bigint/files/12600669/ct_sqrt.pdf), we are performing floor(log2(BITS)) + 2 iterations in Uint::sqrt() (to get x_n and x_{n+1}, where n = floor(log2(BITS)) + 1). But the tests indicate that it may be enough to only do floor(log2(BITS)) iterations. Need to check.

cc @HastD