spec: improve page breaks

Fix the almost empty page, that would only have "2.2.1.1 Counter
Storage" and one line of text, the related table starting a new page
(although no explicit page break was there).

Add a page break before "2.2. SIM/USIM Provisioning" to avoid that
almost blank page, and add some more page breaks before big headlines
for consistency and better readability.
diff --git a/docs/imsi-pseudo-spec.adoc b/docs/imsi-pseudo-spec.adoc
index e3dae4c..a673aa2 100644
--- a/docs/imsi-pseudo-spec.adoc
+++ b/docs/imsi-pseudo-spec.adoc
@@ -70,6 +70,7 @@
 deployed by a MVNO without any changes to the operators of the physical
 infrastructure (MNO).
 
+<<<
 === Summary of Existing Location Updating Procedures in RAN and CN
 
 Every subscriber's SIM/USIM is provisioned with the IMSI and secret
@@ -223,6 +224,7 @@
 applet to detect and ignore outdated requests related to changing the
 pseudonymous IMSI.
 
+<<<
 === SIM/USIM Provisioning
 
 IMSI pseudonymization as specified by this document works with
@@ -305,6 +307,7 @@
 triggered. If `imsi_pseudo_lu` reaches `imsi_pseudo_lu_max`, the SIM applet
 displays a warning to the subscriber.
 
+<<<
 [[process-update-location-hlr]]
 === Process Update_Location_HLR
 
@@ -432,6 +435,7 @@
 PAD: 8 bits::
 Padding at the end, should be filled with 1111 as in the TBCD specification.
 
+<<<
 == Error Scenarios
 
 === Next Pseudonymous IMSI SMS is Lost
@@ -454,6 +458,7 @@
 // === SMS Arrives Before Timer Expires
 // FIXME: OS#4486
 
+<<<
 == Recommendations for Real-World Implementations
 
 === BCCH SI3: ATT = 0
@@ -501,6 +506,7 @@
 * A Samsung GT-E1200 feature phone displays a waiting screen for 16 to 17
   seconds and is unusable during that time.
 
+<<<
 [[reference-src]]
 == Reference Implementation with Source Code