Circuit optimizations

[ebfull]

• [x] sample challenges as squares (sends n from 1667613 to 1223794)
• [x] send challenges as 128-bit over public inputs (sends n from 1223794 to 1104626)
• [x] use endomorphism to speed up inner product 128-bit multiplications (sends n from 1104626 to 901482)
• [x] reduce k to 22 (sends n from 901482 to 881984, proving time from 373.19s to 193.88s, verification time from 33.75s to 24.23s)
• [x] use endomorphism to speed up multiplications for z (sends n from 881984 to 876594)
• [x] multieq some comparisons (sends n from 876594 to 865535)
• [ ] (maybe) compute k(Y) commitment using Pedersen hashes
• [ ] (maybe) compute opening commitments using window table lookups
• [ ] (maybe) don't encode old challenges twice (once in deferred and once in leftovers)

[ebfull]

All of the further optimizations won't get us below 2^19 probably, so I'm not going to bother right now.