r1cs_constraint_processor's join linear combination could be wrong

[weikengchen]

r1cs_constraint_processor.js, given a row (a, b, c), will do the following:

• if b is a constant (say C_b), then it builds Plonk gates for computing a * C_b + c
• if a is a constant (say C_a), then it builds Plonk gates for computing b * C_a + c

This, however, doesn't seem to be correct. It should be:

• a * C_b - c
• b * C_a - c

My feeling is that this bug was never triggered before because in many situations, one would never encounter such a row.