Refer to IntersectionObserver from the Security Considerations

[jcjones]

IntersectionObserver1 and/or IntersectionObserver2 could be valuable to relying parties to determine whether an iframe they are utilizing for WebAuthn is being clearly shown to the user as intended. We should consider adding text to the Security Considerations section referring to the appropriate (final) version(s) of this.

[jcjones]

See also: https://docs.google.com/presentation/d/1sK9hhI0y25iioyLGMKwdhtpe-sVRV7Ln4pMHR2JXApw/edit#slide=id.g3ad57c9b5b_0_13

[jcjones]

Per discussion on 31 July call: J.C. was thinking we should try and write an example, but Jeff argued that we could write verbiage saying something akin to: "When WebAuthn is being rendered in an embedded frame, IntersectionObserver should be used to ensure that the intended UI is displayed by the user agent and is not obscured or occluded in any way."

[jcjones]

On 30 Oct 2019 call, decided to close this one per the argument at TPAC that practically, iframes can always be obscured or made not-credibly-visible.