XS library security audit definition

[dckc]

In an xsnap security discussion (context: #2468), we separated this audit definition from the audit itself (#2466).

I'd rather not slice it so finely, but I'm not sure who I need agreement from.

[dckc]

some background research: #2224

[dckc]

@dtribble points out that documentation of layers below the customer API is likely to be important for a security review.

[Tartuffo]

@jessysaurusrex @warner
This is in the "Up Next" pipeline, but does not have a MN-1 label. If it is needed for MN-1, please label, otherwise move from "Up Next" to "Product Backlog".