clarify nonce usage

[kazuho]

Specifically,

• forbid use of cipher suites with nonce below 12 bytes
• nonce calculation uses lower 32 bites of CID sequence number
• one packet protection key must not cover more than 2^32 CID sequence numbers

Closes #213. Closes #244.

[marten-seemann]

It's a bit unfortunate that we have to say anything about cipher suites in this document. It would be nice if we could just use whatever RFC 9001 defines.

Note that if we decide to introduce path IDs (#214), this would allow us to derive separate keys per path, leaving the nonce usage untouched (compared to RFC 9001). This is tracked by #215.