split PII criterion into 3 levels -- no PII, Only Class III PII, Only Class II PII

[kristovatlas]

Classes I, II, and III are defined in the comment for CR65.

I’m not including the markdown in this commit in order to avoid
cross-fork problems

[dcousens]

ACK, the list is probably not exhaustive, but the intent is clear.

[kristovatlas]

output from validate_json:

$ python validate_json.py obpp3.json
WARNING! The countermeasure 'OBPPV3/CM17' could not be found under any attack in the threat model.
WARNING! The countermeasure 'OBPPV3/CM18' could not be found under any attack in the threat model.
WARNING! The criterion 'OBPPV3/CR48' could not be found under any countermeasure in the threat model.
'obpp3.json' matches the specified schema.