Add guidance on the type of PII to be included in CAWG assertions

CAWG implementors need to be mindful of the types of Personally Identifiable Information (PII) that they embed into CAWG assertions. Due to the wide range of state, national, and international laws governing the protection of PII, it is easy to accidentally add information that some governmental entities will classify as "Restricted" data. When images get labeled as "Restricted", large organizations have to go through extensive measures in order to make sure it is protected according to all the various laws.
Once the number of images with sensitive PII crosses a certain threshold, large companies will have to assume that enough of the CAWG data is sensitive enough to put them at legal risk. They will then be put in the position of either treating all CAWG data as Restricted data, or stripping the CAWG data from the image. Due to the enormous costs and legal risks of handling Restricted data, most companies will opt to remove or redact the CAWG data before storing the image.
In order to avoid the removal/redaction of CAWG data from becoming a standard practice, we should do two things:

- Add language in the standard highlighting this risk and discouraging people from embedding sensitive information directly in the image. We should encourage that people instead include references to where the PII is stored. Since PII laws change frequently, we can't be specific about what not to include. However, we need to have a general warning against adding information that might be classified as protected by governments.
- We need to come up with an internal standard about what is allowed to be used in the documentation that we produce so that we can verify that all new pull requests adhere to our list of allowed examples. Implementors will do whatever the spec tells them to do, so we need to make sure that the spec is not encouraging bad practices.