[protocol spec] Add note about lookup formulae

[daira]

From the QED-it report:

When describing the constraints for the lookup table of the WindowedPedersenCommit, it is not clear how the interpolation was done to vanishing polynomials. It took us some time to figure out that the general way of creating similar polynomials for constraints derived from 3 bits outputs b₀, b₁, b₂ and encoding outputs c₁, ..., c₈ is with the following constraint:
    C(b₀, b₁, b₂) = c₁(b₀)(1 - b₁)(1 - b₂) + c₂(1 - b₀)(b₁)(1 - b₂) + ... + c₈(b₀)(b₁)(b₂)

Add a note about this (but using zero-based indexing for c).

[arielgabizon]

Improved explanation in code zcash/sapling-crypto#95