Some simplifications of vartime division

[fjarri]

• Extract shl/shr by a limb-sized shift into separate methods
• Add a more detailed docstring and some debug assertions in div3by2()
• Replaced saturating_sub with wrapping_sub in several places. While logically it is the same thing (the wrapping/saturation only happens for values that are later selected out), I think there are readability advantages. First, elsewhere in the code we use wrapping ops for selected out values (meaning "perform the subtraction without any checks, since we already have a constant-time condition for that"), so saturating_sub indicates that the algorithm actually uses the saturation mechanic. Second, in case of a bug, it will be easier to spot the consequences of a "0xffff..." value than a 0.

Questions:

• should I move the new shl/shr methods to shl.rs/shr.rs? Are they general enough?
• should div3by2_vartime() be moved out of div_limb.rs?