xds spec: clarify per-resource vs per-response NACK semantics

**If you are reporting *any* crash or *any* potential security issue, *do not*
open an issue in this repo. Please report the issue via emailing
envoy-security@googlegroups.com where the issue will be triaged appropriately.**

*Title*: *One line description*

*Description*:
https://www.envoyproxy.io/docs/envoy/latest/api-docs/xds_protocol does not specify how NACKs should be handled, wrt to partially valid resources.

Consider a response
```
resources:
- name: foo
- name: bar
subfields:
banana: somethingInvalid # this is rejected
apple: something valid
```

There are 3 plausible ways to handle this:
1. Do not apply `foo` or `bar`
2. Apply `foo`, but not `bar`
3. Apply `foo`, and the parts of `bar` that are valid. That is, ignore the `banana` field

I believe (2) is the desired behavior, and the way most (could be all) of Envoy behaves, as does [gRPC](https://github.com/grpc/proposal/blob/master/A46-xds-nack-semantics-improvement.md).

It would be great to verify the intended behavior, codify it in the spec, and audit Envoy's existing implementations to ensure they align with the spec.