Add Bulletproof rewind functionality

[hansieodendaal]

This is closely modelled on Grin's solution, but using two private keys:

• Interfaces:
  • create a rewindable ZK proof with up to 23 bytes additional embedded proof data
  • extract the value and 23 bytes proof data only
  • extract the value, blinding factor and 23 bytes proof data
• Required:
  • two rewind nonces, based on two public rewind keys and the value commitment
  • two blinding nonces, based on the two private rewind keys and the value commitment
• Use:
  • the two rewind nonces are used to extract the value and 23 bytes embedded proof data
  • the two rewind nonces and two blinding nonces are used to extract the value, blinding factor and 23 bytes embedded proof data