v0.3.0

This release follows draft-32 of the Bandersnatch VRF specification.

Added

• Pluggable Transcript trait for Fiat-Shamir transform, replacing the previous
  hard-coded hash constructions. Provided implementations: HashTranscript (SHA-512,
  SHA-256 via counter-mode XOF), Blake3Transcript, Shake128Transcript.
• Suite::Transcript associated type. Nonce generation, challenge derivation,
  and other hash-based operations now go through the transcript abstraction.
• Thin VRF scheme. Merges the Schnorr public-key and VRF I/O DLEQ into a
  single delinearized relation with a Schnorr-like proof (R, s). Supports batch
  verification via randomized multi-scalar multiplication.
• Multi-input IETF VRF using delinearized DLEQ. Proves multiple input-output
  pairs with a single proof via delinearize folding. N=1 is byte-identical
  to single-pair proving. N=0 reduces to a Schnorr signature over additional data.
• Straus multi-scalar multiplication (utils::straus::short_msm) for small
  point counts (n=2..5), with configurable window size. Used in IETF, Pedersen,
  and Thin VRF verification to replace independent scalar multiplications.

Fixed

• Challenge serialization now validates that the value fits in CHALLENGE_LEN,
  rejecting proofs with oversized challenge values.

Changed

• Suite trait now requires a Transcript associated type and nonce/challenge
  methods use the transcript rather than raw hash functions. This is a breaking change
  for custom Suite implementations.
• Removed CHALLENGE_LEN from the Suite trait; it is now a module-level constant
  (utils::common::CHALLENGE_LEN) fixed at 16 bytes (128-bit security).
• Challenge and blinding factor decoding now use suite codec (scalar_decode)
  instead of from_be_bytes_mod_order, so endianness follows the suite configuration.