Move reduction step from BN_mod_exp to BN_mod_exp_mont_word.

Fix BN_mod_exp_simple for a==0 (mod m).
Skip useless round in BN_mod_sqrt (1 is always a square, no need
to test BN_kronecker for it).