Request for security review: WebXR Device API

 Hi!

As we're nearing CR, we'd like to request a final security review for the WebXR
Device API <https://immersive-web.github.io/webxr>, as outlined in the W3C
document review guide <https://www.w3.org/wiki/DocumentReview>. The
security and privacy considerations section of the specification can be
found here <https://immersive-web.github.io/webxr/#security>, along with an
explainer here
<https://github.com/immersive-web/webxr/blob/master/privacy-security-explainer.md>
.

We've had involvement from various people in the privacy and security space
during spec development (including Diane, who I've cc'd), so hopefully
there is not much left to review.

We'd appreciate it if y'all could have a look.

Thanks,
-Manish Goregaokar
WebXR Editor