BUG/MINOR: jwe: Buffer overflow when filling fake cek in case of RSA1.5

BUG/MINOR: jwe: Buffer overflow when filling fake cek in case of RSA1.5

In commit 1a5a333 "BUG/MEDIUM: jwe: substitute random CEK on RSA1_5
decryption failure per RFC 7516 #11.5" we fill a fake CEK with random
data to avoid timing attacks. But the loop that fills the buffer does is
8 bytes at a time but the index was not properly incremented which could
result in a buffer overflow if the "struct buffer" size was too short.

This issue was found by Dmitri Kaslov.

This patch should be backported to 3.4.