mask splitting polys for zk

[alxiong]

Description

Sync with the recent bug fix of Plonk paper on masking the splitting polynomials to ensure successful ZK simulator.

The slight modification in our implementation is that our splitting step degree is n+2 instead of n. (since our splitting polynomials are of degree = n+1, see here and here)
@chancharles92 Do you remember why we decide to do this instead of split_lo + split_mid * X^n + ... as in the paper?

---

Before we can merge this PR, please make sure that all the following items have been
checked off. If any of the checklist items are not applicable, please leave them but
write a little note why.

• Targeted PR against correct branch (main)
• Linked to GitHub issue with discussion and accepted design OR have an explanation in the PR that describes this work.
• Wrote unit tests
• Updated relevant documentation in the code
• Added a relevant changelog entry to the Pending section in CHANGELOG.md
• Re-reviewed Files changed in the GitHub PR explorer

[CLAassistant]

All committers have signed the CLA.

[chancharles92]

Possibly this is because we are using TurboPlonk and the total degree of the quotient poly is different. I believe (n+1) is the best parameter to make each polynomial's degree balanced. If we use n, the last splitted polynomial will have much higher degree.

Also note that we've masked witness polynomials and Z polynomials at the beginning (so their degrees are increased by 1 or 2 initially), the paper also does the same thing.

[chancharles92]

@alxiong Do you know why it's insecure even if we've masked both witness polynomials and Z(X)? Also I saw this from Ariel's post:

Since this seems to not be an exploitable issue, and it seems infeasible to use this to extract any user information;

[chancharles92]

LGTM