Add a Security and Privacy considerations section, as per TAG recommendation (#36)

Author: stephenmcgruer

Overview.bs

@@ -717,3 +717,87 @@ it for transitions, so this feature was removed.
 
 The design space for triggering animations is still open. We welcome input
 on this subject.
+
+<h2 id="appendix-a-considerations-for-security-and-privacy">Appendix A. Considerations for Security and Privacy</h2>
+
+This appendix is <em>informative</em>.
+
+There are no known security or privacy impacts of this feature.
+
+The W3C TAG is developing a
+<a href="https://www.w3.org/TR/security-privacy-questionnaire/">Self-Review Questionnaire: Security and Privacy</a>
+for editors of specifications to informatively answer.
+
+Per the <a href="https://www.w3.org/TR/security-privacy-questionnaire/#questions">Questions to Consider</a>
+
+<ol>
+<li>Does this specification deal with personally-identifiable information?
+<p>No.</p>
+</li>
+
+<li>Does this specification deal with high-value data?
+<p>No.</p>
+</li>
+
+<li>Does this specification introduce new state for an origin that persists across browsing sessions?
+<p>No.</p>
+</li>
+
+<li>Does this specification expose persistent, cross-origin state to the web?
+<p>No.</p>
+</li>
+
+<li>Does this specification expose any other data to an origin that it doesn’t currently have access to?
+<p>No.</p>
+</li>
+
+<li>Does this specification enable new script execution/loading mechanisms?
+<p>No.</p>
+</li>
+
+<li>Does this specification allow an origin access to a user’s location?
+<p>No.</p>
+</li>
+
+<li>Does this specification allow an origin access to sensors on a user’s device?
+<p>No.</p>
+</li>
+
+<li>Does this specification allow an origin access to aspects of a user’s local computing environment?
+<p>No.</p>
+</li>
+
+<li>Does this specification allow an origin access to other devices?
+<p>No.</p>
+</li>
+
+<li>Does this specification allow an origin some measure of control over a user agent’s native UI?
+<p>No.</p>
+</li>
+
+<li>Does this specification expose temporary identifiers to the web?
+<p>No.</p>
+</li>
+
+<li>Does this specification distinguish between behavior in first-party and third-party contexts?
+<p>No.</p>
+</li>
+
+<li>How should this specification work in the context of a user agent’s "incognito" mode?
+<p>No differently. The website should not be able to determine that the user is
+in an "incognito" mode using scroll-linked animations.</p>
+</li>
+
+<li>Does this specification persist data to a user’s local device?
+<p>No.</p>
+</li>
+
+<li>Does this specification have a "Security Considerations" and "Privacy Considerations" section?
+<p>Yes.</p>
+</li>
+
+<li>Does this specification allow downgrading default security characteristics?
+<p>No.</p>
+</li>
+</ol>
+