IndieAuth needs non-normative Privacy Threat Model documentation

Similar to [The Google WebID privacy threat model document](https://github.com/WICG/WebID/blob/master/privacy_threat_model.md), the IndieAuth specification should have a brief non-normative “Privacy Threat Model” or “Privacy Considerations” section, perhaps right after the [Security Considerations](https://indieauth.spec.indieweb.org/#security-considerations) section, or alternatively as a separate document which the spec links to.

(Originally published at: https://tantek.com/2020/286/b1/)

Start by reading the IndieAuth specification's Security Considerations section and the linked Google WebID privacy threat model. Define the relevant privacy threats in a brief non-normative Privacy Threat Model or Privacy Considerations section, or a separate document linked from the specification; done means the privacy guidance is published in one of those forms.

Written by the indexing model from the issue text.