document requirements for content-addressable storage

In #8 I hand-waved the following:

• --cas-url is undocumented:
  https://github.com/freedomofpress/webcat-cli/blob/0bcc6f6faffd296d15c37fc93706d340031af60d/README.md?plain=1#L287-L291
• ...but required:

  cfm@kintsugi public_html % npx webcat enrollment create \
    --policy-file trust_policy \
    --threshold 1 \
    --max-age 15552000 \
    --signer "$HEX1" --signer "$HEX2" \
    --output .well-known/webcat/enrollment.json
  Error: --cas-url is required for sigsum enrollments
  cfm@kintsugi public_html % npx webcat enrollment create \
    --policy-file trust_policy \
    --threshold 1 \
    --max-age 15552000 \
    --signer "$HEX1" --signer "$HEX2" \
    --output .well-known/webcat/enrollment.json \
    --cas-url https://static.space
  Saved enrollment to /Users/cfm/Desktop/public_html/cas/b13fae269f7a844a83048b0e176ec89833c0b596bf25701cc6df51823f7b5b06 (sha256=b13fae269f7a844a83048b0e176ec89833c0b596bf25701cc6df51823f7b5b06).
  

I think this is all consistent with what's described in in #2, but users will need to know:

1. what --cas-url to use; and
2. what do with the files that get saved under cas/.

Review README.md around lines 287-291 and the enrollment create example, then consult the context referenced in issue #2. Document what users should provide for --cas-url and how to handle the files saved under cas/. The issue is done when both requirements are explained for users.