Should we require `manifestid`?

Copy/pasting from @LiaHiscock's comments in https://github.com/WICG/install-element/pull/4#discussion_r2561692967:

"""
Re. the manifestid requirement, that doc looks a bit out of date. Let me try to clarify. Manifest id is an app's unique identifier, and how we determine if an app is already installed, should be updated, etc. Unfortunately, id is not a required manifest field, so only about 4% of apps declare one. For the other 96% of apps, we "compute" an id using the start_url field, see starbucks.com's 'application' tab.

However, this opens the door for security issues, because if the developer changes their start_url, their site will appear to the browser as a completely new app that can be installed (multiple apps-foot-gun situation mentioned in Dan's doc), and existing installs under the former start_url become orphaned.

Dan was a big proponent of the id requirement for the API. IIRC our goal there was that the 2 parameter signature helps with backwards compatibility for existing apps without ids, and ideally the 1 parameter signature usage will grow as more apps adopt ids.
"""

Start with the quoted discussion in pull request #4 and the manifest-id and start_url behavior described here. Determine whether the install API should require manifestid and document the compatibility and orphaned-install consequences; done means the project has a clear, agreed requirement.