leak(PartialNotes): use different randomness for sponsored user and fee recipient in PrivateToken

[just-mitch]

Presently in PrivateToken, Alice (the sponsored user) provides a nonce (needs to be renamed to randomness) that we jam into the notes that get created for both her and Bob (the fee recipient, also the FPC admin).

To ensure the randomness is actually random, we emit it as a nullifier.

That's bad though because we're also emitting the nonce as an unencrypted log so that Bob can recreate his note preimage after the transaction. (Yes, we could encrypt it for Bob, but he'd prefer we choose the cheaper route since he's paying for it).

However, we are passing a point to public that is (bob_npk + nonce)*G and (funded_amount + alice_npk + nonce)*G.

That might look all well and fine, but we're probably going to need to pass funded_amount into public so the FPC can be confident that it isn't getting short-changed (e.g. Alice funds 100 bananas, but that is only, 10 AZT, and her transaction_fee is 20AZT).

Once that happens an observer will be able to compute nonce*G since bob_npk is public, and funded_amount * G, and arrive at alice_npk * G, which they can use as a fingerprint on Alice.

This is solved if we just use a different nonce for Bob. Further, we want to make it so that the thing we emit as an unencrypted log can't be subsequently used to invalidate users' transactions by watching the mempool, seeing the log come out, and immediately submitting a TX that uses that nonce.

So we want alice's nonce/randomness to be the one she supplies. Then we want to compute a new nonce/randomness for Bob as hash(alice_nonce, alice_npk).

That randomness should get emitted as an unencrypted log and a nullifier, and used as the randomness for Bob's point.