Make security and privacy normative

[alexshalamov]

No description provided.

[alexshalamov]

@reillyeon @timvolodine @anssiko Please take a look, give improvement ideas, raise concerns :) This PR intents to fix fragmentation of the DevMotion & Orientation, in relation to security and privacy features.

[anssiko]

Thanks! LGTM.

This aligns the specification's security and privacy considerations with the latest recommendations from the security and privacy domain experts who reviewed the Generic Sensor API.

@dontcallmedom, what is your preferred mechanism to get these spec patches merged? I believe this spec does not have any active editors currently.

[dontcallmedom]

I'm afraid that without a chartered group to work on this, and without a permissive license on the last usable version of the document to fork it in a CG, we're a bit in an IPR limbo re merging patches.

[anssiko]

@alexshalamov, could you rebase this PR, thanks!

[reillyeon]

Discussed at Devices and Sensors WG Face-to-face at TPAC 2018. Agreed to accept this change (once merge conflicts have been resolved).

[anssiko]

Closing this PR since I do not expect Alex to work on this anymore, and opened a new PR in #59 with same changes rebased (and s/&/&/g to fix validation error in new references added in this PR).