Reject too small bits value in BN_generate_prime_ex(), so that it does not risk

Reject too small bits value in BN_generate_prime_ex(), so that it does not risk
becoming negative in probable_prime_dh_safe(). Reported by Franck Denis who
noticed `openssl gendh 0' would segfault.
Fix adapted from OpenSSL RT#2701.

ok beck@ jsing@