Further optimize size of Prio3PrepareState

[divergentdave]

Prio3PrepareState currently stores a measurement share, represented as a seed for the helper or a vector of field elements for the leader. This is a space savings for the helper over the specification, which describes the prepare state as always containing the output share. An implementation note lays out this very optimization.

We could go a step further, and save some space on the leader side with selected VDAFs, if we stored the output share for leaders and the measurement share for helpers. The output share may be smaller than the input share for Prio3Sum, Prio3SumVec with bits > 1, etc. This would be a breaking change to the prepare state, which we expect users to encode and save to disk.