[CSAF] Improve documentation on SSVC reserved namespaces

[tschmidtb51]

Currently, the documentation states about reserved namespaces:

We should provide definite guidance, how tools should handle those namespaces. Here is a suggestion based on RFC 6761:

• example and x_example:
  1. Users SHOULD understand that example names are reserved for use in documentation.
  2. Application software SHOULD NOT recognize example names as special and SHOULD use example names as they would other decision point namespaces.
  3. SSVC APIs and libraries SHOULD NOT recognize example names as special and SHOULD NOT treat them differently.
• test and x_test:
  1. Users are free to use these test names as they would any other decision point namespaces. However, since there is no central authority responsible for use of test names, users SHOULD be aware that these names are likely to yield different results on different networks.
  2. Application software SHOULD NOT recognize test names as special and SHOULD use test names as they would other decision point namespaces.
  3. SSVC APIs and libraries SHOULD NOT recognize test names as special and SHOULD NOT treat them differently.
• invalid and x_invalid:
  1. Users are free to use "invalid" names as they would any other decision point namespaces. Users MAY assume that queries for "invalid" decision point namespaces will always return no responses.
  2. Application software MAY recognize "invalid" names as special or MAY pass them to decision point namespaces resolution APIs as they would for other decision point namespaces.
  3. SSVC APIs and libraries SHOULD recognize "invalid" names as special and SHOULD always return immediate negative responses.

[tschmidtb51]

part of #802

[peinjoh]

Minor: Typo in test -> ii: "SHOULD use example names" should probably be "SHOULD use test names"

We're also having this discussion currently, thank you for requesting this clarification!

[tschmidtb51]

@bernhardreiter Please provide a PR.