Add these as a separate variant from private key encryptions, since they
are created and bounded differently. Since we bound the error term by
half the ciphertext modulus, this commit also changes the bounds to be
specified by number of bits.

For polynomials with zero coefficients exceeding degree bound

Taking Self was weird. Call sites don't need to be updated as
calling associated `Log2::method(x)` is still valid, just a weird thing
to enforce.

This would previously give very large norms values for small negative values close to the negative cutoff

…tatements

Silly mistake but easy to miss: we were storing the message to repeat as a _freshly encoded_ plaintext. The values match, but not the underlying messages! Fix to use the actual plaintext coming out of the decryption, which is not a fresh encoding.

As implemented, this would have almost never been used correctly. The
user would have had to ensure that the existing plaintext message had
the same plaintext polynomial encoding as the provided ciphertext. This
would generally only be true if both were fresh encryptions, in which
case this method is not even necessary.

But keep the AS=T debug assertion

Also use u32 over u64, as std::lib does for various "bit length" operations like Shl, log2, et.

And fail fast if calculating the modulus overflows