Re-add paragraph about how some state keys are reserved

Fixes https://github.com/matrix-org/matrix-spec/issues/1013

data/api/client-server/definitions/client_event_without_room_id.yaml

@@ -38,6 +38,10 @@ properties:
       Present if, and only if, this event is a *state* event. The key making
       this piece of state unique in the room. Note that it is often an empty
       string.
+
+      State keys starting with an `@` are reserved for referencing user IDs, such
+      as room members. With the exception of a few events, state events set with a
+      given user's ID as the state key MUST only be set by that user.
     type: string
     example: '@user:example.org'
   sender: