Separate commitment creation from proof creation in sigma-protocols

[fjarri]

In some of the sigma-protocols (prm, sch, mod) we have a separate Commitment object. In others the commitment variables are created along with the proof itself since the challenge is non-interactive.

It makes sense to extract the commitments in all the protocols: it emphasizes the proof structure, and makes it harder to forget to hash the commitment when generating a challenge (the error that was fixed in #109). Need to see if it would introduce significant boilerplate though.