Short scalars for folding

[codygunton]

The verifier's folding work is $\phi' = L_0(\gamma)\phi + \sum_{i=1}^{k}L_i(\gamma)\phi_i$. In the special case where $k=1$, we have $L_0(\gamma) = 1-\gamma$ and $L_1(\gamma)=\gamma$, so the verifier's folding work is the computation of $\phi' = (1-\gamma)\phi + \gamma \phi_1 = \phi + \gamma (\phi_1 - \phi).$ This means that the folding can be done with a short-scalar MSM.