[Post-Sapling] Support delegated proving with privacy from the prover

[daira]

We know how to do this using proof-of-same-discrete-log:

• Asymmetric payment construction #2277 (comment) and Asymmetric payment construction #2277 (comment) for the original idea (expressed insecurely!);
• Asymmetric payment construction #2277 (comment) for a security fix (also see Asymmetric payment construction #2277 (comment) and Asymmetric payment construction #2277 (comment) and Asymmetric payment construction #2277 (comment));
• Asymmetric payment construction #2277 (comment) for one way of doing the same-discrete-log proof as a Sigma protocol;
• Asymmetric payment construction #2277 (comment) for a potential security problem, and Asymmetric payment construction #2277 (comment) for the solution;
• Asymmetric payment construction #2277 (comment) for a further improvement against DL-breaking attackers.

We originally abandoned this approach due to complexity (which I think was a good decision for Sapling). Given the further analysis that has been done for Sapling since then, I think we know enough now to take the complexity hit for some future circuit version.