Review and Update Security and Privacy Considerations

[mmccool]

• Review Security and Privacy Considerations Sections
• Avoid duplicating details of S&P considerations in other documents (although more general statements are ok, if another document has a more specific one)
• Don't contradict S&P consideration in another document
• Consider making them normative (to align with other documents and make use of normative language like "should not" non-confusing)
• Address missing subsections for Discovery and Profiles

Overlaps/replaces other issues about S&P considerations: #587

[mmccool]

I will start a PR to deal with the "mechanical" parts of this, e.g. making the sections normative, adding assertion spans, etc.
After that, we can deal with aligning/adding/making these assertions consistent with others, and (possibly) adding a discovery.

[mlagally]

We merged a security PR in today's architecture call.