[ZIP 32] Point out that Sapling and Orchard spending keys can be invalid

[str4d]

Section 4.2.3 specifies the (cryptographically negligible) cases in which an Orchard spending key could be invalid. However the ZIP 32 derivation treats spending keys purely as byte arrays, and is written infallibly. We should add a note to the ZIP to remind implementors that derivation could fail, and to handle it how they wish.

Section 4.2.2 also specifies some invalid Sapling key cases, which in our code we've historically just ignored (assuming they won't be hit). But for the orchard crate we've instead exposed the potential failures for the caller to handle (as we have done elsewhere in the protocol, per comments from auditors).