Verify that inputs to contract are within the scalar field to avoid aliasing

[HarryR]

In the Withdraw contract, we must verify that all inputs are within the snark scalar field to avoid aliasing.

For example, there may be multiple uint256 values which wrap-around to produce the same point after scalar multiply, all of these are outside of the field.

Re:

• https://github.com/argentlabs/hopper/issues/9
• Vulnerability allowing double spend semaphore-protocol/semaphore#16
• In verifier, ensure that all public inputs are within the field ethsnarks#140

This will be fixed upstream in Ethsnarks.