"May not" has opposite colloquial and formal interpretations, which is why a lot of documents follow https://www.ietf.org/rfc/rfc2119.txt and use "must not" to avoid any ambiguity.
The CommonMark spec uses "must not" in some places but also "may not" in others. I think it would be clearest to stick with "must not" where possible.