Cite ZIP 215 for Ed25519 signature validation criteria

[philoniare]

notation.tex defines valid Ed25519 signatures by reference to RFC 8032 alone, but
RFC 8032 §5.1.7 explicitly permits two different verification equations:

Check the group equation [8][S]B = [8]R + [8][k]A'. It's sufficient, but not
required, to instead check [S]B = R + [k]A'.

So validity is not determined by the current text. Two conforming implementations can
disagree on whether a signature is valid, and for assurances, guarantees and judgments
that means disagreeing on whether a block is valid.

This came up implementing verification in jam-forge: with only RFC 8032 to work from,
both the verification equation and the treatment of non-canonical encodings have to be
chosen without guidance, and both are consensus-visible. The vectors in
jam-conformance/crypto/ed25519 exist because the answers diverge in practice.

[philoniare]

@davxy Agreed, thanks