Correct the likely-incorrect noise propagation model for CGGI

[j2kun]

I did a best-effort implementation in #275, but got lost in the array of papers that have slightly different formulas for slightly different versions of the CGGI bootstrap.

The noise model has two parts where the current implementation is likely wrong:

• The noise output by a bootstrap, as computed based on the various CGGI and LWE parameters
• The max allowable noise, based on the LWE parameters

Also, pending #296 the noise validation check is effectively trivial anyway, because trivial encryptions are noiseless. So this depends on #296 being implemented.

Some options to rectify this include:

• Getting help from CGGI experts over at Zama
• Finding the place in the tfhe-rs codebase where they compute these formulas (though from what I could tell, they use a nominal baseline, so the exact formula for the max, which I couldn't find, would be different).

Another twist is that, while the current implementation picks a single formula for the noise after a bootstrap, the actual formula depends on which variant of bootstrap one is performing. E.g., doing key switch before or after the blind rotate, or using the BMMV trick (Bourse-Minelli-Minihold-Paillier: https://eprint.iacr.org/2017/1114).

We could lower these high-level bootstrap ops to the constituent pieces and then apply the noise propagation at that level. E.g., noise propagated by key switch only, then noise propagated by blind rotate only, etc. But we don't have that layer of granularity yet. It seems reasonable to pick a "worst case" noise model (taken over all implementations of bootstrap in targeted backends) for the high-level bootstrap API, so that it can be exported to any CGGI library backend, and revisit this when there's a lower level ready to use instead and we want to start lowering directly to hardware.