add privacy & security considerations section per questionnaire

[tantek]

Add a non-normative privacy & security considerations appendix per https://w3ctag.github.io/security-questionnaire/

[tantek]

Since this spec is now becoming a NOTE (non-REC track) at W3C, this can be added in an editor's draft afterwards.

[tantek]

I'd like to include at least a small non-normative section for this.