chacha8rand: Specify counter in state compression encoding

> This, combined with the 33 byte length specified above, indicates that this is a 1-byte counter. But nowhere is it specified what this is counting.
>
> My guess is that this is meant to be the ChaCha8 counter (which is guaranteed to fit into 1 byte), rather than a count of how many of the 992 bytes per rekey have been output (which would require a 2-byte counter). But the unspecified implication is that when randomness is sampled that only consumes part of a block, the remainder of the block is discarded. That in turn means that the sample output is only going to match for continuous reads (or reads of a multiple of 992 bytes).

_Originally posted by @str4d in https://github.com/C2SP/C2SP/pull/41#discussion_r1387518977_