Security and Privacy section needs to change to reflect new font feature

[nigelmegitt]

Introducing the #font feature changes the security and privacy implications, since external resources can now be fetched, and previously they could not.

We need to update the section and complete a new Security questionnaire to initiate horizontal review for security.

Apologies for catching this late, but better than never!

In terms of specific changes to the IMSC 1.2 draft, I suggest that we merely need to remove the TTML2 P.8 from the exception list in Appendix K.