Adds Prio3 a set of verifiable distributed aggregation functions.

[armfazh]

Prio3 supports several variants for aggregating data measurements in a privacy preserving manner.
This implementation is compliant with v13 of CRFG draft VDAF https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-vdaf-13#name-prio3

[cjpatton]

This looks really good!

[armfazh]

Items todo:

• Make Encode() constant time so doesn't leak measurement.
• Add a unit test for Query(), to catch invalid query randomness
• Mul of polynomials using NTT

[cjpatton]

Items todo:

* Make Encode() constant time so doesn't leak measurement.

* Add a unit test for Query(), to catch invalid query randomness

* Mul of polynomials using NTT

Feel free to punt the NTT optimizations to a future PR.

[armfazh]

Items Completed:

• Make Encode() constant time so doesn't leak measurement.
• Add a unit test for Query(), to catch invalid query randomness
• Mul of polynomials using NTT -- Tracked at prio3: Implement polynomial multiplication in NlogN  #525

This is ready for a second review, cc: @cjpatton

[cjpatton]

A couple more comments then I think this is good to go.

[cjpatton]

GitHub is burying the unresolved comments, so here are the unresolved threads for convenience:
#522 (comment)
#522 (comment)