Add more detail to security section

[mjwilson-google]

This is to fix #185

[mjwilson-google]

@cwilso please take a look. I tried to capture the firmware concerns in an objective way, and tried to reorganize and slightly clean up the previous section while keeping the content.

We will have a security review pass as part of the road to Recommendation, and it doesn't have to be perfect, but all concerns we know about should be included in this section.

[hoch]

Could you add what are being done specifically? It looks like a big change and not sure what to focus on as a reviewer.

Does this handle tasks listed in #185 (comment)?

[mjwilson-google]

Sorry, it's implementing the plan in the last comment in the issue:
#185 (comment)

One change from the plan is I use three categories instead of two for the
pre-existing prose, but I think that worked better.

If you would like me to go over it with you in more detail please let me
know.

[cwilso]

Looks good. I added a few comments, and suggested some changes, but overall approved.