Support Anoma stdlib sign-detached API

[paulcadman]

This PR adds support for the Anoma stdlib sign-detached API.

builtin anoma-sign-detached
axiom anomaSignDetached : {A : Type}
  -- message to sign
  -> A
  -- private key
  -> Nat
 -- signature
  -> Nat;

This corresponds to the sign_detached libsodium API.

This is requried to support to new Anoma nullifier format:

anoma/anoma@d6a6145

Previously resource nullifiers were defined using anomaSign:

nullifier (r : Resource) (secretKey : Nat) : Nat :=
  anomaSign (anomaEncode (nullifierHeader, r)) secretKey;

They are now defined using anomaSignDetached:

nullifier (r : Resource) (secretKey : Nat) : Nat :=
  let encodedResource : Nat := anomaEncode (nullifierHeader, r) in
  anomaEncode (encodedResource , anomaSignDetached encodedResource secretKey);

This is so that a logic function can access the nullified resources directly from the nullifier field.

Evaluator Note

When decoding a public key, private key or signature from an integer atom to a bytestring it's important to pad the bytestring to the appropriate number of bytes. For example a private key must be 64 bytes but the corresponding encoded integer may fit into 63 bytes or fewer bytes (depending on leading zeros). This PR also fixes this issue by adding a atomToByteStringLen function with also accepts the expected size of the resulting bytestring.