feat(tee): add support for recoverable signatures

[pbeza]

What ❔

This PR is part of the effort to implement on-chain TEE proof verification. Signatures produced by the TEE Prover are now compatible with the on-chain verifier that uses the ecrecover precompile.

Why ❔

Until now, we've been using non-recoverable signatures in the TEE prover with a compressed ECDSA public key in each attestation – it was compressed because there are only 64 bytes available in the report attestation quote. That worked fine for off-chain proof verification, but for on-chain verification, it's better to use the Ethereum address derived from the public key so we can call ecrecover in Solidity to verify the signature.

This PR goes hand in hand with:

• feat(tee-key-preexec): support for Solidity-compatible pubkey in report_data teepot#228
• feat(tee-proof-verifier): add support for Solidity-compatible pubkey in report_data teepot#240
• feat(tee-proof-verifier): add backward compatibility logic teepot#245

Checklist

• PR title corresponds to the body of PR (we generate changelog entries from PRs).
• Tests for the changes have been added / updated.
• Documentation comments have been added / updated.
• Code has been formatted via zkstack dev fmt and zkstack dev lint.

[slowli]

You can use the zksync_crypto_primitives library; it has this functionality (and one used in the unit tests below) implemented.

[pbeza]

I was excited to hear we had all the crypto primitives ready to reuse, but when I dove in, it turned out they were kinda inconvenient or even impossible to use because:

1. Some primitives are defined as pub(super), pub(crate), or totally private. I don't really get why, TBH.
2. Some of our crypto wrappers are way less convenient than the primitives they actually wrap.

I reused what I could, but I still had to almost copy-paste some of the existing primitives. :( Overall it seems the number of LOC increased. :P Lemme know if I'm missing something.

zksync-era/core/bin/zksync_tee_prover/src/tee_prover.rs

Lines 223 to 241 in 27ad86e

	/// Recovers the public key from the signature for the message
	fn recover(signature: &Signature, message: &Message) -> Result<Public> {
	let rsig = RecoverableSignature::from_compact(
	&signature[0..64],
	RecoveryId::from_i32(signature[64] as i32 - 27)?,
	)?;
	let pubkey = &SECP256K1.recover_ecdsa(&Message::from_slice(&message[..])?, &rsig)?;
	let serialized = pubkey.serialize_uncompressed();
	let mut public = Public::default();
	public.as_bytes_mut().copy_from_slice(&serialized[1..65]);
	Ok(public)
	}
	/// Convert public key into the address
	fn public_to_address(public: &Public) -> Address {
	let hash = keccak256(public.as_bytes());
	let mut result = Address::zero();
	result.as_bytes_mut().copy_from_slice(&hash[12..]);
	result

[pbeza]

@slowli @haraldh, pls re-review. Thanks!