Make decryption of TaggedNote not depend on "field overflow"

[benesjan]

Right now we are heavily abusing that we will likely fail during bad decryption as some field will likely end up not fitting into Fr modulus. This is turning out to be problematic as we sometimes get false successful decryptions. Re-work it to use some other approach.

Better longer term approach is to fix the computation of note ids and then we can put the initialization vector into that field as well and use it as a mac. In that case, if the initialization vector matches then you have decrypted it correctly.

See this discussion for context.

Look for "TODO(#7053)" in the codebase.