zips28.little-endian.0

[daira]

Significant changes included in this branch:

• Specify precisely the data to be signed, using a single signature covering all of the transaction except
  pourPubKey and pubSig.
• Define types for serialized fields.
• New terminology (coin -> note, serial number -> nullifier, and Pour -> Xref).
• Switch to little-endian encoding, consistent with Bitcoin.
• Use standard AEAD_CHACHA20_POLY1305 without the minor optimization.
• Remove a_pk from note plaintexts, fixing a related security bug.

[ebfull]

I am still convinced that pours should contain their own pourSig/pourPubKey just like we agreed upon during calgary. It is more flexible, makes verification more isolated, and requires breaking less code and tests that we've already written. We shouldn't make a change like that at this point anyway unless it's motivated by security.