Audit all APIs which are not allowed in PiP windows

[domenic]

Although the explainer API tries to only expose Document, it's quite easy to get from a Document object to its corresponding Window object, e.g. via pipWindow.document.defaultView or pipWindow.__proto__.__proto__.__proto__.constructor("this") or similar.

So this will require a comprehensive audit of which APIs are enabled in PiP windows, versus disabled, since all APIs are reachable. We've done similar work for prerendering, which resulted in the following spec changes so far: https://wicg.github.io/nav-speculation/prerendering.html#intrusive-behaviors