Propose high level control flow for JS-style brightness APIs

[willmorgan]

For the screen brightness API (or extension), per the discussion on #338 on the topic of security and privacy, I think that a high level description of control flow would be useful to set boundaries around permissions, repeated calls to the API, encapsulation, UA/device specific behaviours, and feature policy.

These should be added to the explainer.

Happy to take this on myself (I can't self-assign on this repo!)

[willmorgan]

This seems to have already been taken care of here: #335 (comment)