Sensitive info: describe local attackers, confused users, and mitigations

[jyasskin]

From https://github.com/w3cping/privacy-threat-model/pull/12#discussion_r393975377, the sensitive information threat model needs to include:

• Abusers who temporarily get access to a user's device,
• Users who got confused by a permission prompt,
• Users who change their minds after granting permission,

and we should describe some mitigations browsers can use.