Support more optimized proofs for aggregation (e.g mastic)

[bmcase]

From discussion in Berlin.

Level 1 currently supports Prio3 for the aggregation proofs which can be quite large. In Level 2 we may want to support other zero knowledge proofs like Mastic (see discussion and numbers in #256 (comment)).

Mastic support sparse histograms (1 non-zero bin); if we want to support multiple non-zero positions (but a limited number of them) then we could have multiple Mastic proofs in one report.

[divergentdave]

I think integrating DPFs will definitely be useful for improving efficiency with high-cardinality labels. There are a few other areas of the design space to consider, like including multiple DPF shares in a report, along with one proof constraining the secret shares from each, or having the DPF encode a block of field elements from the large sparse vector instead of a single element. Both of these ideas come from PREAMBLE, though that mechanism allows for some loss in its encoding.