Jubjub Fixes

[HarryR]

This implements the following new gadgets:

• IsNonZero - ZeroP, returns 1 if the input is non-zero
• NotLowOrder - Verify if a curve point is of low order
• Validator - Combine NotLowOrder and IsOnCurve
• Commitment - multi-point fixed-base commitment, for Pedersen Hashes
• PedersenHash - using Commitment

Removes the following coordinates systems from jubjub.py:

• Montgomery Affine
• Montgomery XZ
• Edwards YZ

I've also added a C++ implementation of Point, and made the from_y operation consistent between the C++ and Python implementations by detecting the sign of the X coordinate and inverting it if necessary. This was necessary because the different implementations of modulo square root returns differently signed values.

This also merges in code from: #81 with the following gadgets:

• fixed_base_mul_zcash
• MontgomeryToEdwards
• MontgomeryAddition
• lookup_signed_3bit_gadget

I am working on tests.

[swasilyev]

May be redundant:
if x != 0, x * (1 - y) = 0 implies y = 1
if x = 0, x * (1/x) = y implies y = 0

Suggested change

generate_boolean_r1cs_constraint<FieldT>(pb, m_Y);

[HarryR]

The boolean constraint is needed for Y because M is specified as a witness and not validated on its own - if Y is forced to be 0 or 1, then the only valid value for M is 1/X