Verify that inputs to contract are within the scalar field to avoid aliasing

[HarryR]

In the Withdraw contract, we must verify that all inputs are within the snark scalar field to avoid aliasing.

For example, there may be multiple uint256 values which wrap-around to produce the same point after scalar multiply, all of these are outside of the field.

Re:

• https://github.com/argentlabs/hopper/issues/9
• https://github.com/kobigurk/semaphore/issues/16
• https://github.com/HarryR/ethsnarks/issues/140

This will be fixed upstream in Ethsnarks.