Gather requirements for the LTI 1.1 Security Update

From #850.

In order for us to pursue IMS certification after 31st December 2019, we need to implement either LTI 1.3 or a ["Security Update" to LTI 1.1](https://www.imsglobal.org/spec/lti/security-update/v1p0).

The security update may be a small-enough amount of work compared to LTI 1.3 that it would be worth doing before we come to LTI 1.3. This also involves investigating the support for this change with the various major LMSes.

The "Security Update" does not explain what issue exactly is mitigated, but it mentions an XSRF attack. A detailed explanation with worked example of the security issue can be found here: https://community.brightspace.com/s/article/Update-on-LTI-Vulnerability-LTI-Launch-with-New-Security-Requirements.