[css-values-5] Add Security entry for attr()

Author: tabatkins

css-values-5/Overview.bs

@@ -1981,3 +1981,9 @@ Security and Privacy Considerations</h2>
 	and default font size,
 	but both are trivially observable from JS,
 	so they do not constitute a new privacy risk.
+
+	The ''attr()'' function allows HTML attribute values
+	to be used in CSS values,
+	potentially exposing sensitive information
+	that was previously not accessible via CSS.
+	See [[#attr-security]].