note considerations wrt credential processing in private/incognito context

[equalsJeffH]

Apparently, browser-based password managers treat credential processing (create(), store(), get()) differently in private/incognito context as compared to "normal" context (is there a different term for the latter?). A quick grep of the credential-management spec as well as the issues list did not turn up any hits relevant for this topic, hence creating this new issue. There is some sentiment that different browsers have differing notions of what private/incognito browsing mode(s) mean—i.e., what the service level contract is—hence couching the title of this issue in terms of "considerations", rather than implying any normative specification for such behavior.