Packed provable type which can save constraints

[mitschabaude]

This is an idea I got while studying the list / tree data structures used in @mrmr1993's token zkapp examples.

Those examples represent big dynamic data structures by a hash, and perform complex branching-type logic on the hashes instead of the original values. This can save a lot of constraints compared to branching on the full values.

Even without hashing, just representing values as fewer field elements in any way can result in a reduction of constraints. Here, I introduce and export a Packed<T> provable type, which uses information about the bit length of types to pack them into as few field elements as possible.

I use Packed to pack elliptic curve points in the ECDSA gadget from 6 to 3 field elements, and get rid of 2k constraints in the part where we select a point from an array.

Note: This is not a replacement for o1js-pack, because Packed<T> doesn't currently support unpacking the values from the packed field elements alone, so it can't be used to save onchain state. Packed also holds onto an Unconstrained which contains the original value. For the pattern where we represent values by their hash, instead of their packed field elements, knowing the original value is of course necessary.