HPACK Security Considerations

I have written what I think is a slightly more robust Security Consideration for HPACK.  This covers:
* the attack in the general sense, 
* how the attack might apply in HPACK and HTTP, 
* particular areas of concern, 
* how HPACK inherently mitigates these attacks, 
* what environments might need additional mitigation, and
* some suggested mitigation strategies.

Mitigation strategies that I have described are:
* actor-based isolation (a generalized application of the origin isolation principle)
* destroy values on failed guesses (thanks here to Adam Barth for the idea), either probabilistically, or based on a count, with a recommendation that shorter values be made harder to guess
* specific protection for "special" header fields

There are a few formatting changes in the first commit, sorry.