Spec should document fingerprinting and XSLeak risk

[pes10k]

This review is part of the requested PING review.

The proposed functionality may increase fingerprinting risk and cross-site information flows, depending on how browsers make autoplay decisions.

If browsers make autoplay decisions based on any of following inputs (incomplete list), the new functionality contributes to fingerprinting risk:

• a profile/browser setting
• a global permission setting
• an OS level setting or feature (e.g., data saving, battery status)
• etc

If browsers make autoplay decisions based on any of the following inputs (incomplete list), the new functionality may create a new cross-site information flow.

• whether any media is playing (or has played) on anther page/tab
• whether the site has instances open on other pages (playing or otherwise)

These are important, privacy-relevant decisions and factors implementors will need to consider, and should be incorporated into the privacy considerations section.