Add a checklist to the security considerations template?

Our [MSC template](https://github.com/matrix-org/matrix-spec-proposals/blob/main/proposals/0000-proposal-template.md) contains the following section for security considerations:

> ## Security considerations
>
> **All proposals must now have this section, even if it is to say there are no security issues.**
>
> *Think about how to attack your proposal. See [RFC 3552](https://datatracker.ietf.org/doc/html/rfc3552)
for things to think about, but in particular pay attention to lists from sources like
[OWASP Top Ten](https://owasp.org/www-project-top-ten/) for inspiration.*
>
> *Some proposals may have some security aspect to them that was addressed in the proposed solution. This
section is a great place to outline some of the security-sensitive components of your proposal, such as
why a particular approach was (or wasn't) taken. The example here is a bit of a stretch and unlikely to
actually be worthwhile of including in a proposal, but it is generally a good idea to list these kinds
of concerns where possible.*

This already links to [RFC 3552](https://datatracker.ietf.org/doc/html/rfc3552) and [OWASP Top Ten](https://owasp.org/www-project-top-ten/) as inspiration for things to consider. These are generic and not specific to Matrix, however. It might also be too easy for authors to just skip them entirely given that they're just links. Maybe we could improve this situation by extracting a checklist of things to consider into the template while continue to link to these sources for further inspiration?

From recent security discussions on proposals I was involved in and without putting too much thought in it, the following things come to mind:

- [ ] Denial of service (ReDoS, ...)
- [ ] Impact of leaking metadata from clients to homeservers
- [ ] Impact of malicious homeservers on other servers and / or clients
- [ ] Impact of malicious clients on other clients and / or homeservers

Start with proposals/0000-proposal-template.md and review its existing RFC 3552 and OWASP Top Ten links alongside the checklist ideas in this issue. Done means the security considerations section includes an agreed, useful checklist while retaining links for further guidance.

Written by the indexing model from the issue text.