Shared ZK implementation

[hannahdaviscrypto]

Partially addresses #947.

A module for computing fully linear proofs on data that is already secret shared, using the Prio3 method to derive joint randomness from the input shares via an XOF.

[hannahdaviscrypto]

@cjpatton Would love if you could take a look at this, thank you!

[cjpatton]

Kicking this off with a round of Rust-related comments. I'll get to the crypto bits once the code starts to smooth out. Looking good so far!

[divergentdave]

I noticed that you rebased or cherry-picked main onto this feature branch. This doesn't work well because each new change from main increases the diff between the feature branch and the last common ancestor commit, which means more chances for conflicts. Ideally, the diff should only have the new src/szk.rs file, and two lines in src/lib.rs declaring the new module.

There are a few ways to get out of this loop. Merging main into this feature branch would give you a new last common ancestor commit, thus simplifying the diff, though leaving the branch with a complicated history. Rebasing in the other direction, i.e. rebasing the feature branch onto the latest commit from main, would provide the cleanest end result history, though it may take some care. The commits that already appear on main would need to be dropped: rebasing can often do this automatically, but if not this can be manually controlled in an interactive rebase. There may be conflicts to resolve along the way as well, particularly for fixup commits touching existing parts of the library. I think you could alternatively squash the whole feature branch into one commit by first doing a soft reset, cleaning up the changes in the index by unstaging changes from cherry-picked main commits, and then creating a new commit from the index's contents.

[cjpatton]

Looking really good. I have one substantive question (inline); all others I think are easy to resolve. I would expect just one more round of review from me.

[divergentdave]

Looking good! My one major comment is on the API of Szk::decide(), as there's currently a hole between query() and decide() that has to be bridged with some manual unsharding and Option reshuffling.

[cjpatton]

👏 LGTM. Before merging:

1. Let's make sure @divergentdave is happy
2. We need to squash this into a single commit.

[divergentdave]

Looking good, I have a few small comments.

[hannahdaviscrypto]

Squashed and ready to merge, pending CI checks! @cjpatton