Remove `Fp128` from the specification

[tgeoghegan]

Fp128, the 128 bit prime order field, only gets used in test vectors, and was used in the paper to compare against another proof system that works in a 128 bit field. But in practice, we expect Longfellow to be used only with Fp256 (for ECDSA P-256 signatures) and GF(2^128) (for SHA-256). We should remove mention of Fp128 and instead provide test vectors in Fp256 so that implementations don't have to deal with an extra, test-only field.