Validate JoinSplit proofs

[conradoplg]

Motivation

We need to validate JoinSplit Groth16 proofs from post-Sapling Sprout transactions. (Pre-Sapling use BCTV14 proofs, but since we checkpoint on Canopy, we don't need to validate them.)

Specifications

JoinSplit descriptions are described in https://zips.z.cash/protocol/protocol.pdf#joinsplitdesc

The primary input encoding is not documented yet; see https://github.com/zcash/librustzcash/blob/0ec7f97c976d55e1a194a37b27f247e8887fca1d/zcash_proofs/src/sprout.rs#L152-L166 for the reference implementation.

Designs

Solution

• Add support for encoding JoinSplits in order to verify them
• Add test to make sure verification works
• Rename spend_prepared_verifying_key to joinsplit_prepared_verifying_key which is more appropriate
• This does not add batch verification since it will required some changes to zcash_proofs, will be done in Support batch verification of JoinSplit Groth16 proofs #3127
• Does not actually make Zebra validate the proofs, that will be done in Integrate async JoinSplit Groth16 verifier with transaction verifier #1835

Closes #322

Review

@dconnolly and/or @upbqdn can review this.

Reviewer Checklist

• Code implements Specs and Designs
• Tests for Expected Behaviour
• Tests for Errors

Follow Up Work

Actually using this to validate proofs will be done in #1835

Adding support for batch verification is #3127

[dconnolly]

Looking good! Some suggestions and proposals

[dconnolly]

Some rustdoc improvements and a merge conflict to resolve but functionally ✅

[conradoplg]

Some rustdoc improvements and a merge conflict to resolve but functionally white_check_mark

👍 Conflicts solved