[protocol spec] In 4.1.11, GroupHash^G(r) should be GroupHash^G(r)* (for Sapling but not Orchard)

[daira]

Orchard complicated this because in that case $\mathsf{GroupHash}^{\mathbb{G}^{(r)}}$ is correct.