Refactor RedJubjub to serialize the pubkey internally

[str4d]

The current implementation serializes R || M because this was how RedJubjub was originally specified. Late in the Sapling development process, this was altered to R || vk || M to make a security proof easier. The code was not altered at the time because all RedJubjub callers were already prepending pubkeys to their messages before signing, which is functionally identical.

We should refactor RedJubjub to instead serialize vk internally, so that the callsites do not need to care, and the implementation more closely matches the spec.

[daira]

More precisely, it's not that the security proof was made easier; it's that Strong Unforgeability under Randomised Keys does not hold generically unless the public key is included in the hash.

[daira]

The redjubjub crate was refactored to be a wrapper over the reddsa crate in ZcashFoundation/redjubjub#152 (in February 2023, included in redjubjub 0.7.0 which depends on reddsa 0.5.0). reddsa 0.5.0 does do the prefixing itself, for signing and for verification. So there is nothing more to do here.