Prio3: Add support for multiple proofs

[cjpatton]

Partially addresses #839.
Stacked on #851.

As of draft-irtf-cfrg-vdaf-08 it's possible to configure to Prio3 so that the Client generates (and the Aggregators verify) multiple FLPs for the same measurement. This commit adds support for this feature. While at it, this commit de-duplicates some of the code used to derive field elements from seeds.

[cjpatton]

I'll rebase on top of #851.

[cjpatton]

Rebased!

[divergentdave]

Looks good! I checked benchmark performance, and all differences were within the noise threshold, so no worries there.

[inahga]

🎉

[divergentdave]

FYI, I was working through re-enabling Prio3 test vectors, and I noticed that the Prio3SumVecWithMultiproof_0.json file was generated using an algorithm ID of 0xFFFFFFFF. That may or may not be an oversight in the spec, but note that this implementation keeps using the same Prio3SumVec algorithm ID passed through from the SumVec Type impl. (We don't need to block merging this PR for this issue, and can fix the algorithm ID or test vector file in a followup)

[cjpatton]

FYI, I was working through re-enabling Prio3 test vectors, and I noticed that the Prio3SumVecWithMultiproof_0.json file was generated using an algorithm ID of 0xFFFFFFFF. That may or may not be an oversight in the spec, but note that this implementation keeps using the same Prio3SumVec algorithm ID passed through from the SumVec Type impl. (We don't need to block merging this PR for this issue, and can fix the algorithm ID or test vector file in a followup)

We didn't intend to allocate codepoints for these, so the algorithm ID is fine. In fact, generating test vectors for these was an oversight on my part (cfrg/draft-irtf-cfrg-vdaf#315). I suggest we remove them.

[cjpatton]

Rebased and squashed.