Verification circuit (compute_b part)

[simonmasson]

This implements one part of the verification circuit: the compute_b part (see here).

The circuit computes $\prod_i (1+u_{k-1-i} x^{2^i})$ but for 32 challenges $u_i$, it runs out of memory when it computes the $x^{2^i}$ (in the Expression part)...

The implementation works for 16 challenges $u_i$.

@joebebel @XuyangSong any idea? IIRC, we face the similar problem as for the hash_to_curve function but I don't know how to get rid of it in this context.