Add Marvin Attack on rsa crate

[tarcieri]

See: RustCrypto/RSA#19 (comment)

https://people.redhat.com/~hkario/marvin/

[tarcieri]

I'm working on adding the prerequisites to crypto-bigint needed to fix this problem, but it's going to be a lot of work (it presently uses a fork of num-bigint which wasn't designed for constant-time cryptography)

[Shnatsel]

This is good to go as-is, but if you think a patched version is going to go out in a week or two I'm fine with holding it back until that is available.

[tarcieri]

I'm a bit worried about publishing an advisory which has no call-to-action / mitigation. But given the potential severity, it's probably better to inform users and channel discussion to places where we can give authoritative answers, rather than having people discover it elsewhere and speculate.

A week or two might be an ambitious target for fixing this, although I have implemented most of the necessary functionality to do so in the crypto-bigint crate. That said, there's a large amount of algorithm implementation code in the rsa crate which will need to be adapted, and I expect that will take some time.