[permissions] Faking permissions (#54)

I suggest to state in the standard that the web browser MUST allow the user to fake permission. If the permission is faked, the priveleged API user
* MUST get FAKE information instead of genuine one
* MUST get the response from ```navigator.permissions.query``` as if the permission was really granted

FAKE information is the information generated by any combination of 2 means:
1 a secure PRG
2 a model, not using any data about user's machine

---
Reply to this email directly or view it on GitHub:
https://github.com/w3c/permissions/issues/54