Switch to little endian encoding for everything

[ebfull]

This depends on

• Switch to little endian sapling-crypto#72 which depends on
• Add read_le and write_le to PrimeFieldRepr zkcrypto/pairing#82

[daira]

I'm not sure whether https://github.com/zcash/librustzcash/pull/12/files#diff-745d270700285c73dedf7767652465d7R155 and https://github.com/zcash/librustzcash/pull/12/files#diff-745d270700285c73dedf7767652465d7R159 are correct. They might be, but I recommend dropping the .rev() and implementing a LittleEndianBitIterator.

[daira]

utACK

[daira]

My ACK assumes that we will add test vectors generated by @str4d's independent implementation.

[ebfull]

We will be adding those test vectors, but this PR will not block on them.

[str4d]

I have test vectors for key components, but g_d is failing. I'll figure it out tomorrow.

[ebfull]

We now have test coverage of Pedersen commitments, hashes, (merkle tree empty roots consistent with zcashd), note commitments, addresses/ivk, group hash, and most (all?) of jubjub.

[str4d]

g_d was failing in my local test vectors because the first Pedersen base was invalid, due to not rejecting points where v was not in the field. Test vectors in this PR include the fix.

[str4d]

ACK+cov. I generated the test vectors and wrote the tests that use them, so my ACK does not cover those.