specs: document CID string format rules

[bnewbold]

We have "syntax" helpers in go (indigo repo, here) and typescript (atproto repo) for permissively validating CID strings (without actually "parsing" them with CID semantics). And have interop test vectors. But don't seem to have this string syntax documented in the specs yet!

These are relevant for Lexicon validation with the string format=cid, as distinct from cid-link in the data model.