Output a hash of the R1CS

[iamrecursion]

In order to guard against the (improbable) program transformation outlined in this paper we want to compute a hash of our constraint system that can be used as the first Fiat-Shamir challenge.

A few baseline requirements:

• It should be part of the compiled artefacts, not something printed to stdout.
• It should be a new field in the R1CS struct that covers all other fields.
• The hash itself should be sufficiently cryptographically secure (e.g. sha256, keccak256).

We probably want to do something along the lines of add a new struct as follows (naming obvs tbc):

#[derive(Clone, Debug, Serialize, Deserialize)]
struct SealedR1CS {
    system: R1CS,
    digest: [u8; 32]
}

We would then add a new method—R1CS::seal : Self -> SealedR1CS—that takes the constraint system and computes the hash over it, producing the resultant SealedR1CS. We would then move the existing methods on R1CS (compute_derivatives, check_witgen_output and check_ad_output) onto R1CSSealed, so there is no way that the R1CS could be mutated under its hash.

Most of the places in the API where we currently output R1CS would instead be replaced by SealedR1CS, as this is intended to be the client-facing artefact after this work.