[css-contain] Expand the security and privacy section

Closes #1376

Author: frivoal

css-contain/Overview.bs

@@ -328,6 +328,68 @@ Privacy and Security Considerations {#privsec}
 
 This specification introduces no new privacy or security considerations.
 
+Like any other CSS specification, it affects the rendering of the document,
+but does not introduce any special ability to present content in a misleading way
+that was not previously available through other CSS modules
+and that isn't inherent to the act of formatting the document.
+
+The <a href="http://www.w3.org/2001/tag/">TAG</a> has developed a <a href="https://www.w3.org/TR/security-privacy-questionnaire/">self-review questionaire</a>
+to help editors and Working Groups evaluate the risks introduced by their specifications.
+Answers are provided below.
+
+<dl>
+<dt>Does this specification deal with personally-identifiable information?
+<dd>No.
+
+<dt>Does this specification deal with high-value data?
+<dd>No.
+
+<dt>Does this specification introduce new state for an origin that persists across browsing sessions?
+<dd>No.
+
+<dt>Does this specification expose persistent, cross-origin state to the web?
+<dd>No.
+
+<dt>Does this specification expose any other data to an origin that it doesn’t currently have access to?
+<dd>No.
+
+<dt>Does this specification enable new script execution/loading mechanisms?
+<dd>No.
+
+<dt>Does this specification allow an origin access to a user’s location?
+<dd>No.
+
+<dt>Does this specification allow an origin access to sensors on a user’s device?
+<dd>No.
+
+<dt>Does this specification allow an origin access to aspects of a user’s local computing environment?
+<dd>No.
+
+<dt>Does this specification allow an origin access to other devices?
+<dd>No.
+
+<dt>Does this specification allow an origin some measure of control over a user agent’s native UI?
+<dd>No.
+
+<dt>Does this specification expose temporary identifiers to the web?
+<dd>No.
+
+<dt>Does this specification distinguish between behavior in first-party and third-party contexts?
+<dd>No.
+
+<dt>How should this specification work in the context of a user agent’s "incognito" mode?
+<dd>No difference in behavior is needed.
+
+<dt>Does this specification persist data to a user’s local device?
+<dd>No.
+
+<dt>Does this specification have a "Security Considerations" and "Privacy Considerations" section?
+<dd>Yes, this is the section you are currently reading.
+
+<dt>Does this specification allow downgrading default security characteristics?
+<dd>No.
+</dl>
+
 <h2 class="no-num" id="changes">Appendix A. Changes</h2>
 
 This appendix is <em>informative</em>.