feat!: byte-sort private outputs to obfuscate note order

BREAKING!

Before: Commitments, nullifier, and ciphertexts of a transaction were
position-aligned. The position revealed which nullifier was hiding a
pre-state to a commitment to which post-state. Similarly with
ciphertexts.

After: The nullifier-cipher connection remains, but now they (and
commitments independently) are shuffled by the byte-order of the
hashes.

Mitigation: Expect the circuit outputs to be jumbled.

lee/privacy_preserving_circuit/src/output.rs

@@ -261,6 +261,17 @@ pub fn compute_circuit_output(
         emit_dummy_output(&mut output, dummy);
     }
 
+    output
+        .new_commitments
+        .sort_unstable_by_key(Commitment::to_byte_array);
+
+    let mut notes: Vec<_> = core::mem::take(&mut output.new_nullifiers)
+        .into_iter()
+        .zip(core::mem::take(&mut output.encrypted_private_post_states))
+        .collect();
+    notes.sort_unstable_by_key(|((nullifier, _), _)| nullifier.to_byte_array());
+    (output.new_nullifiers, output.encrypted_private_post_states) = notes.into_iter().unzip();
+
     output
 }