Improve security section to address TAG feedback

[mlagally]

See w3ctag/design-reviews#736
for details.

[rhiaro]

Just so people don't need to keep clicking around, I'll paste my feedback on Security & Privacy here as well:

Overall we are happy with the direction, and really appreciate the extensive security and privacy work that has been done. Treating all Thing Descriptions as if they contain PII is a sensible precaution. Making the Security and Privacy considerations normative makes a strong statement, though we'd like to know how you have been testing these requirements for conformance purposes?

The spec refers normatively to the Security and Privacy Guidelines, but this is a NOTE, not a normative document and so can't be used as a normative reference. Are you planning to republish the Guidelines at some point (as it seems to have been updated since its last publication)? Also the Security Best Practices document appears to currently be unpublished - what status are you planning to give to this? How does it relate to the Guidelines?

[mlagally]

Discussion in Arch call on 1. Sept:
It is planned to update the "Security and Privacy" document this fall as it is an informative document.
However some constraints are essential, e.g. using recent versions of TLS.
We define these as part of the normative S&P section of the architecture document.

We will change the references to the "Security and Privacy" document to "informative".

[mlagally]

Arch call on Sept 22: S&P reference was changed to informative.