[book] Fix p_poly to match implementation; specify synthetic blinding factor f construction

[therealyingtong]

p_poly is constructed as a linear combination of q_prime and the q_polys in steps 18 and 19 of the protocol description. Previously, the expression used in the protocol description did not match the implementation:

• halo2/halo2_proofs/src/poly/multiopen/prover.rs

  Lines 105 to 113 in 5678a50

  	let (p_poly, p_poly_blind) = q_polys.into_iter().zip(q_blinds.into_iter()).fold(
  	(q_prime_poly, q_prime_blind),
  	|(q_prime_poly, q_prime_blind), (poly, blind)| {
  	(
  	q_prime_poly * *x_4 + &poly.unwrap(),
  	Blind((q_prime_blind.0 * &(*x_4)) + &blind.0),
  	)
  	},
  	);

• halo2/halo2_proofs/src/poly/multiopen/verifier.rs

  Lines 120 to 129 in 5678a50

  	// Compute the final commitment that has to be opened
  	msm.append_term(C::Scalar::ONE, q_prime_commitment);
  	let (msm, v) = q_commitments.into_iter().zip(u.iter()).fold(
  	(msm, msm_eval),
  	|(mut msm, msm_eval), ((q_commitment, _), q_eval)| {
  	msm.scale(*x_4);
  	msm.add_msm(&q_commitment);
  	(msm, msm_eval * &(*x_4) + q_eval)
  	},
  	);

[daira]

ACK with non-blocking suggestion; doc-only.

[daira]

ACK, this change looks correct. (I have not fully reviewed the protocol.) Doc-only.

[daira]

ACK with nonblocking suggestions.

[daira]

ACK with suggestions.

[therealyingtong]

Suggested change

	* $\prover$ finally sets $q_0(X) := x_1^2 q_0(X) + x_1 h'(X) + r(X)$.
	* $\prover$ finally sets $q_0(X) := x_1^2 q_0(X) + x_1 h'(X) + r(X)$ and $q^*_0 := x_1^2 q^*_0 + x_1 h'^* + r^*$.

[therealyingtong]

Suggested change

	3. $\prover$ sends a commitment $R = \innerprod{\mathbf{r}}{\mathbf{G}} + [\cdot] W$ where $\mathbf{r} \in \field^n$ are the coefficients of a randomly sampled univariate polynomial $r(X)$ of degree $n - 1$.
	3. $\prover$ sends a commitment $R = \innerprod{\mathbf{r}}{\mathbf{G}} + [r^*] W$ where $\mathbf{r} \in \field^n$ are the coefficients of a randomly sampled univariate polynomial $r(X)$ of degree $n - 1$.