Document new keyshare protocol

[sietseringers]

This documents the new keyshare protocol. It includes the paper on which it was based.

Two notes:

• This PR assumes that the irmago version number under which the new keyshare protocol is going to be released is v0.14.0. If that turns out not to be the case, then this needs to be changed here.
• This PR assumes that the keyshare server's JWT at the end of the keyshare protocol is only sent by the client to the requestor in case of issuance, and not when diclosing or signing. This is how it is currently implemented in Feat: use new keyshare protocol in irmaclient irmago#327, which is fine. However, the keyshare paper suggests to always forward that JWT to the requestor. If that is implemented at some later stage, then this will need to be updated here.