Issue #294 - Add a non-normative comment about snapshotting BufferSou…

…rces (#1074)

* Issue #294 - Add a non-normative comment about snapshotting BufferSources

* Add cross-link to WebIDL for "get a copy of the bytes held by the buffer source"

[=get a copy of the bytes held by the buffer source=] should have autolinked
to WebIDL, but it wasn't. I tried debugging it for a bit, but ultimately
decided to just manually specify the link. I think if a bikeshed expert wants
to fix this, go right ahead, but this works presently.

index.bs

@@ -196,6 +196,9 @@ spec: SP800-800-63r3; urlPrefix: https://pages.nist.gov/800-63-3/sp800-63-3.html
         text: something you know; url: af
         text: something you have; url: af
         text: something you are; url: af
+spec: webidl; urlPrefix: https://heycam.github.io/webidl
+    type: dfn;
+        text: get a copy of the bytes held by the buffer source; url: dfn-get-buffer-source-reference
 
 </pre> <!-- class=anchors -->
 
@@ -964,6 +967,10 @@ This [=internal method=] accepts three arguments:
 Note: <strong>This algorithm is synchronous:</strong> the {{Promise}} resolution/rejection is handled by
 {{CredentialsContainer/create()|navigator.credentials.create()}}.
 
+Note: All {{BufferSource}} objects used in this algorithm must be snapshotted when the algorithm begins, to
+avoid potential synchronization issues. The algorithm implementations should [=get a copy of the bytes held
+by the buffer source=] and use that copy for relevant portions of the algorithm.
+
 When this method is invoked, the user agent MUST execute the following algorithm:
 
 1. Assert: <code>|options|.{{CredentialCreationOptions/publicKey}}</code> is [=present=].
@@ -1330,6 +1337,10 @@ This [=internal method=] accepts three arguments:
 Note: <strong>This algorithm is synchronous:</strong> the {{Promise}} resolution/rejection is handled by
 {{CredentialsContainer/get()|navigator.credentials.get()}}.
 
+Note: All {{BufferSource}} objects used in this algorithm must be snapshotted when the algorithm begins, to
+avoid potential synchronization issues. The algorithm implementations should [=get a copy of the bytes held
+by the buffer source=] and use that copy for relevant portions of the algorithm.
+
 When this method is invoked, the user agent MUST execute the following algorithm:
 
 1. Assert: <code>|options|.{{CredentialRequestOptions/publicKey}}</code> is [=present=].