Implement GS over linked Groth16 verification

[jdwhite48]

Similar to Issue #1, but with Groth-Sahai also treating some number a_0, ..., a_{k-1} of G16 public inputs as GS hidden variables, which supposedly links the n Groth16 proofs together in some fashion (agnostic to the operation of GS).

• Also passing this as input into the prove function and with prepared_pub_input being Σ_{i=k}^{\ell [0]} a_0,i W_0,i instead, by simple bilinear group arithmetic properties a single GS-compatible Groth16 verification equation would take the following form:

e( C_0, -vks[0].delta_g2 ) * e( S_0, -vks[0].gamma_g2 ) * e( A_0, B_0 ) = e( vks[0].alpha_g1, vks[0].beta_g2 ) * e( prepared_pub_input[0], vks[0].gamma_g2 )

where S_0 = Σ_{i=0}^{k-1} a_0,i W_0,i. For Groth-Sahai, gets encoded as the following Equation struct fields:

Γ = [ 1, 0, 0 ], A = [ 0 ], B = [ 0, - delta_g2, - gamma_g2 ] and t = e(alpha_g1, beta_g2) * e(prepared_pub_input, gamma_g2).

where the EquProof consists of X = [ A_0, C_0, S_0 ], Y = [ B_0 ].

• Similarly, implement a basic verify function that takes the commitments to X and Y, together with n (EquProof, VerifyingKey, prepared_pub_input) as input, and re-interprets the n Equation as before to verify that GS' EquProof is a valid witness to the satisfiability of linked Groth16 verification equations.