…t#226)

* Expose the last outputs and number of steps from RecursiveSNARK (microsoft#285)

Both of these data are easily accessible, and could be very useful
to clients:
* Exposing the last outputs allows us to get the current state of
  the computation on the prover side without wasting energy
  recomputing it
* Exposing the number of steps makes it easier to eventually pass
  `num_steps` into `CompressedSNARK::verify`

* Improve error handling (microsoft#286)

* When a function already returns a `Result`, propagate errors
  instead of panicking with `expect`
* For `NovaError::SynthesisError`, retain information about the
  original bellpepper error. Since `NovaError` implements `Clone`
  but bellpepper's `SynthesisError` does not, we keep the error
  information as a `String`.

This commit only fixes low-hanging fruit in lib.rs, for functions
that already return a `Result` and can easily propagate errors just
by replacing `expect(...)` with `?`. There are still many `unwrap()`
calls in functions returning `Result` in other modules, particularly
gadgets. But I don't understand the code well in those parts, and I
suspect some of those `unwrap()`s actually can't fail based on
invariants of the code, so it makes perfect sense to leave them as is.

Co-authored-by: Francois Garillot <[email protected]>

---------

Co-authored-by: Jeb Bearer <[email protected]>

See microsoft#222, the commit_open_prove_verify test is subsumed by the subsequent unit test.
@tchataigner was right from the start.