Implement R1CS of anonymous transactions in Zether style

[osuketh]

The statements are following:

• Amount check: \sum s_i C_i = b_1 + \sum r s_i * y_i ,where b_1: transferred amount
• Amount check: \sum (s_i + t_i) C_i = \sum (s_i + t_i) r * y_i
• Amount check: (1 - s_i)(1 - t_i) C = (1 - s_i)(1 - t_i) r * y_i
• Randomness check: D = r * G
• Balance check: \sum s_i (C_li - C_i) = b_2 G + sk (\sum s_i C_ri - D) ,where b_2: remaining balance
• Secret key check: sk G = \sum s_i y_i
• Nonce check: sk * G_epoch = u
• Spend authority: rvk = alpha * G + pgk
• s_i \in {0, 1}
• t_i \in {0, 1}
• \sum s_i = 1
• \sum t_i = 1
• b_1 \in [0, MAX]
• b_2 \in [0, MAX]