Add CDDL to every extension

[jcjones]

The extensions currently describe their CBOR as example octets; these can be more precisely defined using CDDL, and we should add normative CDDL for each extension.

[ttaubert]

None of the example octets for the currently listed extensions use indefinite length encoding. When we define them using CDDL, can we add a note that allows definite length encoding only? That should simplify CBOR parsers quite a bit.

[jcjones]

Avoiding indefinite length encoding is a good security goal in general, whatever the encoding format. Per @ttaubert, I'd recommend we add that to the implementation considerations as part of this change.

[kpaulh]

I agree. CTAP is already requiring their CBOR to be canonical, which means no indefinite length encoding.

[selfissued]

There was agreement on the 28-Feb-18 call that CDDL isn't needed for most extensions, since the transformations between the JavaScript data structures and the CBOR data structures are now obvious.