Consider bringing back Blake3-192 variant

During #2472, proving with`Blake3_192` (192-bit / 24-byte output) was removed because Plonky3 lacks the `CryptographicHasher` trait implementation.

We should consider whether or not we want to bring it back. Experiments show that it leads to a reduction in proof size in the order of $17$% in comparison to Blake3-256 variant, but with our planned move to targeting 100+ bits of security it might not be worth the effort.