[Security docs] Note that heuristic API gating is hypothetical.

Bug: None
Change-Id: I1667617b44ee4bb999de3d0b18eacd56a84b9d79
Reviewed-on: https://chromium-review.googlesource.com/1079324Reviewed-by: Andrew Whalley <awhalley@chromium.org>
Commit-Queue: Andrew Whalley <awhalley@chromium.org>
Cr-Commit-Position: refs/heads/master@{#562934}

docs/security/side-channel-threat-model.md

@@ -338,6 +338,9 @@ clocks, and we want the OWP to be able to support them.
 
 ### Gating Access To APIs That Enable Exploitation
 
+**Note:** This section explores ideas but we are not currently planning on
+implementing anything along these lines.
+
 Although we want to support applications that necessarily need access to
 features that enable exploitation, such as `SharedArrayBuffer`, we don’t
 necessarily need to make the features available unconditionally. For example, a