Create separate VerifyingKey structures for pre- and post-optimisation circuits

[str4d]

The current VerifyingKey represents the post-optimisation circuit; however it does so in a way that isn't reproducible without access to the circuit. This causes issues with e.g. defining a stable serialization format (#449).

Separately, we also need a well-defined VerifyingKey suitable for passing into a circuit gadget for verifying a proof (#435, #436).

We should refactor the VerifyingKey structure to separate pre- and post-optimisation concerns, to make it very clear what is needed in the latter case and enable us to start defining more concretely how we want to encode it in the various consuming contexts.

[str4d]

We made some exploratory code changes in Halo 2 Office Hours today, to figure out how to approach the post-optimisation VerifyingKey structure. The resulting changes are in #781, along with the conclusions we drew from them about how the real refactor should work.

[daira]

The VerifyingKey structure should include the number of public input elements.