client-hints-05+ updates

Hey folks.

Unfortunately won't be able to attend the meeting in Singapore. A quick
summary of recent updates on Client Hints:


   - We added Accept-CH-Lifetime
   <https://github.com/httpwg/http-extensions/issues/372> to allow origins
   to persist their hint preferences:
      - ACL should address one of the primary limitations we heard from
      implementers: they need hints to be available on navigation requests, not
      just subrequests.

      - Accept-CH-Lifetime preference is bound to the origin
      - e.g. 3P's pref on foo.com is bound to foo.com

      - We restricted *both* Accept-CH and Accept-CH-Lifetime opt-in to
   secure transports
      - Effectively, CH is now HTTPS-only.

      - Above updates also resulted in substantial rewrite of the security
   considerations
   <http://httpwg.org/http-extensions/client-hints.html#security-considerations>
   section.
      - Kudos to Martin for lots of help on this one.

Also, lots of other smaller (editorial) updates — see #373
<https://github.com/httpwg/http-extensions/pull/373> for full details.

PTAL and would appreciate any feedback.

ig

*p.s. I'll be offline until early Dec, apologies upfront for tardy replies.*