Co-authored-by: Jack Grigg <jack@electriccoin.co>

SinsemillaInstructions has two const generic parameters: K, which
is the number of bits in each word of the hash, and MAX_WORDS,
which is the maximum number of words the hash can process.

For Orchard, K = 10, MAX_WORDS = 253.

This defines a Sinsemilla message in terms of pieces and subpieces.
This is useful when decomposing field elements and packing them
into K-bit messages.

The chip that will implement SinsemillaInstructions.

The 2^K table of generators used in the Sinsemilla hash. These
are loaded into a lookup table.

witness_message() witnesses a full message given a bitstring.

The other two APIs, witness_message_piece_bitstring() and
witness_message_piece_field(), both witness a message piece, i.e.
part of a message that fits within a single base field element.

witness_message_piece_bitstring() takes in a bitstring, while
witness_message_piece_field() takes in a field element. In the
latter case, the number of words encoded must be specified.

Also, GeneratorTable::configure() was not being called in the main
SinsemillaChip::configure(), which meant the lookup argument had
not been activated. This has now been fixed.

Co-authored-by: Jack Grigg <jack@electriccoin.co>

These expressions are derived multiple times in the gates.

Co-authored-by: Jack Grigg <jack@electriccoin.co>

This toggles the assignment of q_s2 on the last row of each piece.
We assign q_s2 = 2 on the last row of the final piece, and q_s2 = 0
on the last row of other pieces.

This allows us to process the final_piece in the main loop together
with the other pieces.

Co-authored-by: Jack Grigg <jack@electriccoin.co>

hash_piece() is an internal API, which means its caller hash_message()
is working in the same region. We rely on the caller to have already
assigned each piece's initial x_a at the correct offset before making
the call to hash_piece().

Co-authored-by: Jack Grigg <jack@electriccoin.co>

The gates "Secant line" and "Sinsemilla gate" were using the same
selectors and could be combined.

Co-authored-by: Jack Grigg <jack@electriccoin.co>

Co-authored-by: Daira Hopwood <daira@jacaranda.org>
Co-authored-by: Jack Grigg <jack@electriccoin.co>

This allows the MockProver to see the fixed_y_q query as semantically
connected to q_sinsemilla1.

Co-authored-by: Jack Grigg <jack@electriccoin.co>

Signed-off-by: Daira Hopwood <daira@jacaranda.org>