graphsync spec - expand on in order traversal requirement

[chafey]

I just learned yesterday that the graphsync protocol requires blocks be sent from responder to requester in selector traversal order. This requirement exists so the client can detect a malicious server that is trying to DOS it (without the in order requirement, client side validation of blocks becomes much more complex and resource intensive as it would have to cache or keep track of blocks that it cannot yet validate). This topic should be expanded upon in the spec. Adding this issue here for tracking, I will update the spec later once I have enough updates to do