Implement Nova's Offchain-Decider circuits (#160)

* Implement Nova's Offchain-Decider circuits (on both curves)
  (curve1 circuit: ~152k constraints, curve2 circuit: ~8k constraints)
  following the enumeration of the Offchain Decider docs:
  https://privacy-scaling-explorations.github.io/sonobe-docs/design/nova-decider-offchain.html
* Update enumeration of checks in Onchain-Decider circuit
  (decider_eth_circuit.rs) to match the updated Onchain Decider docs:
  https://privacy-scaling-explorations.github.io/sonobe-docs/design/nova-decider-onchain.html

folding-schemes/src/folding/circuits/cyclefold.rs

@@ -61,10 +61,10 @@ where
         f().and_then(|val| {
             let cs = cs.into();
 
-            let cmE = GC::new_variable(cs.clone(), || Ok(val.borrow().cmE), mode)?;
-            let cmW = GC::new_variable(cs.clone(), || Ok(val.borrow().cmW), mode)?;
             let u = NonNativeUintVar::new_variable(cs.clone(), || Ok(val.borrow().u), mode)?;
             let x = Vec::new_variable(cs.clone(), || Ok(val.borrow().x.clone()), mode)?;
+            let cmE = GC::new_variable(cs.clone(), || Ok(val.borrow().cmE), mode)?;
+            let cmW = GC::new_variable(cs.clone(), || Ok(val.borrow().cmW), mode)?;
 
             Ok(Self { cmE, u, cmW, x })
         })

folding-schemes/src/folding/circuits/mod.rs

@@ -7,10 +7,13 @@ pub mod nonnative;
 pub mod sum_check;
 pub mod utils;
 
-/// CF1 represents the ConstraintField used for the main folding circuit which is over E1::Fr, where
-/// E1 is the main curve where we do the folding.
+/// CF1 uses the ScalarField of the given C. CF1 represents the ConstraintField used for the main
+/// folding circuit which is over E1::Fr, where E1 is the main curve where we do the folding.
+/// In CF1, the points of C can not be natively represented.
 pub type CF1<C> = <<C as CurveGroup>::Affine as AffineRepr>::ScalarField;
-/// CF2 represents the ConstraintField used for the CycleFold circuit which is over E2::Fr=E1::Fq,
-/// where E2 is the auxiliary curve (from [CycleFold](https://eprint.iacr.org/2023/1192.pdf)
-/// approach) where we check the folding of the commitments (elliptic curve points).
+/// CF2 uses the BaseField of the given C. CF2 represents the ConstraintField used for the
+/// CycleFold circuit which is over E2::Fr=E1::Fq, where E2 is the auxiliary curve (from
+/// [CycleFold](https://eprint.iacr.org/2023/1192.pdf) approach) where we check the folding of the
+/// commitments (elliptic curve points).
+/// In CF2, the points of C can be natively represented.
 pub type CF2<C> = <<C as CurveGroup>::BaseField as Field>::BasePrimeField;