Replace assert_contains with assert_contains_and_remove.

[LeilaWang]

The previous Set.assert_contains can be misleading.
A note in a Set might have been destroyed. But this could still generate a valid proof:

set.assert_contains(note);
do_something();

However, the ability to check if a note hash exists is useful. Because a note might not be shared via log. In which case, the user gets the preimage offline, and should be able to call a contract function with the preimage to claim a note or do something.

Before we add the feature properly, we can use assert_contains_and_remove to check that the note hash does exist, and destroy the note right after, to prevent developers making wrong assumption.

Checklist:

Remove the checklist to signal you've completed it. Enable auto-merge if the PR is ready to merge.

• If the pull request requires a cryptography review (e.g. cryptographic algorithm implementations) I have added the 'crypto' tag.
• I have reviewed my diff in github, line by line and removed unexpected formatting changes, testing logs, or commented-out code.
• Every change is related to the PR description.
• I have linked this pull request to relevant issues (if any exist).