Flp: Add post-processing step that uses verifier randomness

[cjpatton]

A common trick in designing the arithmetic circuit is to set the output to a random linear combination of intermediate values. The only option for computing this is to use the joint randomness, which incurs the cost of using a larger field (for Fiat-Shamir). Another option is to use randomness generated by the verifier themself.

One way we could do this is to define a postprocessing step for Flp that is run the verifier, but not the prover. In applications like Prio3, the randomness used could be derived from the verify key just as as the query randomness is done today.

The joint randomness would still be needed wherever it is used as input to a gadget, as would be the case for (the current design of) the SumVec type (see #124).

This could be seen as an alternative to #262.

[cjpatton]

Closing in favor of #262.