rend-spec: Rename client authorization to restricted discovery.

As mentioned in arti!2212 (merged) and arti#1476, we are deprecating the "client authorization" terminology:

• services that encrypt the second layer of their descriptor are said to be running in "restricted discovery" mode
• the corresponding client "auth" keys are referred to as service "discovery keys".

Questions for the reviewer:

• should we update the attic version of rend-spec-v3 too?
• should we update rend-spec-v2, or any other attic documents?

I considered updating the proposals referencing client auth as well, but ultimately decided against it: for the most part, they seem to be historical documents, and they often reference older/deprecated terminology (which is to be expected, because they aren't living documents). If you disagree, LMK and I'll update them!