Add Security Considerations and Privacy Considerations sections

[noncombatant]

Example security considerations:

• What stops malicious web origins from attacking vulnerabilities in USB devices/device controllers? Devices and their controllers do some non-trivial packet handling and they are programmed on the cheap and not updated.
• vendorId and deviceId make potential exploits somewhat easier to make reliable ("Don't try all vulns we have exploits for; that might crash the device controller. Instead, we know we can use the exploit we have for FooCorp Device Model 123.")

Example privacy consideration:

• This API creates long-lived, high-resolution, undeletable device/user/client IDs via serialNumber, vendorId, and deviceId.

Example mitigation:

• WebUSB is a special permission that browsers only give origins with explicit user knowledge and consent (like Geolocation, for example).

...but then the spec needs to describe the requirements for the knowledge and consent ceremony.

[reillyeon]

I've updated the spec with a high-level discussion of the security and privacy risks as well as specifics on how devices authorize origins. Details on the knowledge and consent ceremony are still sparse as I'm not sure how much the spec should leave up to browsers:

https://reillyeon.github.io/webusb/#security-and-privacy-considerations