Rewrite privacy considerations on fingerprinting in start_url

[mgiuca]

Closes #1113

This change (choose at least one, delete ones that don't apply):

• Adds new normative recommendations or optional items

(No implementation commitment required as it adds a MAY requirement.)

Commit message:

Rewrite privacy considerations on fingerprinting in start_url.

There is a "MUST NOT" requirement for developers about putting user data
in the start_url. This is not enforceable, so rewriting the paragraph:

1. Removed this requirement for developers.
2. Added a non-normative note that tells developers it would be
   irresponsible to do this (but acknowledging that we can't practically
   prevent it).
3. Added a MAY requirement for user agents to offer to uninstall apps
   associated with an origin when clearing site data.

---

Preview | Diff

[mgiuca]

@marcoscaceres the change is a bit hard to read because it's based off of #1112 which runs tidy and other changes. The relevant changed section is around line 810.

[marcoscaceres]

I'm still a bit worried about exporting "start URL" without an associated thing... could it be:

Suggested change

	represents the <dfn data-export="">start URL</dfn> , which is
	represents the <dfn class"export" data-dfn-for="installed web application">start URL</dfn> , which is

And yes, we still need a formal definition of a "web application".....

[marcoscaceres]

Actually, seems we have defined "installed web application" 🎉

[mgiuca]

This is commenting on a PR that was already submitted (#1112). (It just got caught up in this PR's delta because it wasn't submitted at the time I uploaded this.) I've rebased now, which should make things clearer.

You may be right, but I would like you to put this up as a separate PR if you don't mind. It's a bit complex as I've now got text in manifest-incubations which links to this and will have to be updated when you make this change.

[marcoscaceres]

Sorry for the delay... some suggestions.

[mgiuca]

Thanks for the review. I've rebased so it's now current against HEAD.

I accepted most of your suggestions, just pushing back against the new sentence about UAs messing with start URLs.

[marcoscaceres]

Thanks @mgiuca. I agree that until such times that user agents strip things out (if ever) then there is probably no need to mention it. Just as an example, I think mail.app does strip out known identifiers... so there is some precedent.