Fix inconsistency: Informing the user and requiring user consent is always per-origin

[ddorwin]

When consent is required in the Get Consent Status algorithm, the UA is to "Request user consent to use accumulated configuration in the origin and wait for the user response" (emphasis added).

When that algorithm returns InformUser, the UA is to "Inform the user that accumulated configuration is in use in the origin..." (emphasis added).

https://w3c.github.io/encrypted-media/#security-prompts and https://w3c.github.io/encrypted-media/#privacy-prompts both say (emphasis added):

Such alerts and consent SHOULD be per origin to avoid valid uses enabling subsequent malicious access and MUST be per browsing profile.

That "SHOULD" should be "MUST" to be consistent with the algorithms.

[mwatson2]

I agree.