Privacy and Security section should mention that a user agent may choose to not expose cross-origin PerformanceServerTiming entries even with TAO

Concerns about using server timing for tracking have prevented us from enabling PerformanceServerTiming in WebKit.  If we limited it to same-origin even when TAO headers may be present, that would help us enable it.