Privacy: Add Data Clearing and Credential Availability protections

[mohamedamir]

Closes #???

Fills remaining gaps for the W3C Privacy Questionnaire:

• Data Clearing: Clarifies that clearing browser site data is expected to clear any API intermediation caches, though it won't clear credentials stored inside external managers/OS.
• Avoiding leaks of credential availability: States the expectation that User Agents return generic error types and normalize response timings so that websites cannot probabilistically determine if a user possesses a credential based on how fast the request is rejected.
  Addresses parts of Horizontal Review - Privacy #232.

The following tasks have been completed:

• Modified Web platform tests (link)

Implementation commitment:

• WebKit (link to issue)
• Chromium (link to issue)
• Gecko (link to issue)

Documentation and checks

• Affects privacy
• Affects security
• Pinged MDN
• Updated Explainer
• Updated digitalcredentials.dev

---

Preview | Diff