Adjust loop bound for rejection sampling

[jschneider-bensch]

I had recently introduced a loop bound for rejection sampling during signing (cf. #558). Going from the comment in the code I went for a bound of 576 attempts, which should give a failure probability of less than 2^-128. However, the standard actually prescribes a higher mandatory minimal number of attempts, giving a failure probability less than 2^-256.