Refactor Proof APIs to take Public and Private input as separate structs

[cronokirby]

See the ConvertProof introduced in #3556 as an example of doing this. The idea is that each proof will have a related struct for the public inputs and private inputs to the circuit. We should also make the fields of the Circuit struct private, only allowing creating circuits via the DummyWitness trait.

Some advantages of this:

• It makes it clearer what the public and private inputs are.
• It removes duplication of parameters between proving and verifying.
• It makes the functions have fewer parameters, whereas now they have a lot, to the point that clippy complains.
• It makes writing a Rust version of the circuit satisfaction code easier.

Circuits that need to be changed:

• Spend
• Output
• DelegatorVote
• UndelegateClaim
• Swap
• SwapClaim
• NullifierDerivation