Use NotAllowedError instead of SecurityError when appropriate

[noamr]

See https://wicg.github.io/local-font-access/#dom-window-querylocalfonts
(3) is a SecurityError because it's an origin violation, but (4) and (5) should probably be NotAllowedError because those are about transient activation and permission policy (see existing use of these errors).