Add brillig optimized implementation of sha256

[TomAFrench]

The current sha256 implementation is optimized for ACIR proving however this results in an unnecessarily high number of brillig opcodes. We can use std::runtime::is_unconstrained() to dispatch to an implementation of this which is optimized for brillig.

[TomAFrench]

Main issues are along the lines of this loop not terminating early when reaching the end of the message, having conditional assignment of a pointer, etc. which can all be removed in brillig:

sha256/src/sha256.nr

Lines 75 to 99 in 8e7ed7f

	for i in 0..num_blocks {
	let msg_start = BLOCK_SIZE * i;
	let (new_msg_block, new_msg_byte_ptr) =
	unsafe { build_msg_block(msg, message_size, msg_start) };
	if msg_start < message_size {
	msg_block = new_msg_block;
	}
	if !is_unconstrained() {
	// Verify the block we are compressing was appropriately constructed
	let new_msg_byte_ptr = verify_msg_block(msg, message_size, msg_block, msg_start);
	if msg_start < message_size {
	msg_byte_ptr = new_msg_byte_ptr;
	}
	} else if msg_start < message_size {
	msg_byte_ptr = new_msg_byte_ptr;
	}
	// If the block is filled, compress it.
	// An un-filled block is handled after this loop.
	if (msg_start < message_size) & (msg_byte_ptr == BLOCK_SIZE) {
	h = sha256_compression(msg_block, h);
	}
	}