docs: add CSS-based XSS and privacy leak prevention to non-goals

[g-k]

fix: #627

This one took me longer to get too than anticipated.

This PR does not claim support for any browsers in favor of waiting until we can test output in them E2E #242

[willkg]

We should probably add protecting users from clicking on urls that have malicious or harmful content. I think that's come up a few times and we haven't explicitly stated it's a non-goal.

Also, this non-goals list is pretty long. Maybe there's a better way to think about this? Maybe we can list Bleach's goals and then list everything else in a "These are the other things you should be thinking about that Bleach doesn't cover...." section?

[g-k]

We should probably add protecting users from clicking on urls that have malicious or harmful content.

Good call! In "Safely create links" we have:

Bleach does not try to verify the validity or safety of the domains linked to beyond being well-formed

so it seems weird to duplicate that into non-goals.

Maybe there's a better way to think about this?

Agreed! Maybe rewording them and moving them to FAQ page?

The non-goals is already unwieldy and could be unbounded. We could also cover some other common issues in it and link to it from the issue bug template with some "hey did you check the FAQ?" text.

Hopefully it'd make people more likely to read the goals page too.

[willkg]

Let's land it as it is now.

Before we do a 5.0.0 release, I'll do a pass through the docs (I forget what's in them--it's been a long while) and we can iterate over reducing, reorganizing, and clarifying then.

[g-k]

ok sounds good. We have #397 for updating the docs.