- Have the caller to `cyclic_recursion` create and pass in the virtual proof
- Split `dummy_proof` into preprocessing and proving, so that we don't need to redo the preprocessing work in each `set_cyclic_recursion_data_target` call
- Have the caller update `num_public_inputs` instead of doing it in `cyclic_recursion`. This is a little less convenient but I think it's best not to modify the caller's config (principle of least surprise)
- Have `set_cyclic_recursion_data_target` take a sparse set of public inputs. Taking some PIs with the lowest indices didn't seem very general. I still have some reservations about this part of the API - I think it would seem cleaner if PIs of a proof which wasn't selected for verification were simply ignored - but perhaps there are some optimization reasons to keep using them.
Followup to #806.
A few goals here
- Zero dependencies on std. (Previously deserialization depended on std for `Cursor`.)
- Provide a single (memory buffering) impl of `Write` to make sure there's no confusion. (Previously `Buffer` and `Vec<u8>` both implemented it.)
- Move closer to the `std::io` APIs. Hopefully they will be available without std at some point (there have been some discussions...).
More specifically, this
- Changes `Buffer` to not use std's `Cursor`.
- Removes `impl Write` for `Buffer`, since it's implemented for `Vec<u8>`.
- Adds a concrete I/O error type to mimic `std::io`'s.
- Combines `Position` and `Size` into `Remaining`.
We don't think this is required for soundness, but just to remove any doubt.
Old protocol:
```
...
P sends final_poly
V samples random r
P sends pow_witness (not in transcript)
V computes pow_response = H(r, pow_witness)
V asserts pow_response has N leading 0s
...
```
New protocol:
```
...
P sends final_poly
P sends pow_witness
V samples random pow_response
V asserts pow_response has N leading 0s
...
```
