Add link to NIST SP 800-63B 2nd public draft to 3.3.8 / 3.3.9 understanding (#4351)

Incorporate outside references about allowing pasting into password
fields.

This change offsets stances about preventing pasting passwords. Even
NIST plans to recommend allowing it:

> 3.1.1.2 Password verifiers
> 
> [...]
> 
> Verifiers SHALL allow the use of password managers. **Verifiers SHOULD
permit claimants to use the “paste” functionality when entering a
password to facilitate their use**. Password managers have been shown to
increase the likelihood that users will choose stronger passwords,
particularly if the password managers include password generators


> 8.2.1 Passwords
> 
> [...]
> 
> Usability considerations for typical usage without a password manager
include:
> 
> [...]
> * User experience during entry of the password
> * **Support copy and paste functionality in fields for entering
passwords, including passphrases.**


> 8.2.3 Out-of-band
> 
> [...]
> 
> Usability considerations for typical usage include:
> 
> [...]
> 
> **Consider offering features that do not require text entry on mobile
devices (e.g., a copy-paste feature)**, which are particularly helpful
when the primary and secondary channels are on the same device. For
example, it is difficult for users to transfer the authentication secret
manually using a smartphone because they must switch back and forth —
potentially multiple times — between the out-of-band application and the
primary channel.

Co-authored-by: Mike Gower 

Author: patrickhlauke

understanding/22/accessible-authentication-enhanced.html

@@ -108,6 +108,7 @@ Resources
             <li><a href="https://webauthn.io/">WebAuthN Demo sitea>.li>
             <li><a href="https://en.wikipedia.org/wiki/OAuth">OAuth on Wikipediaa>.li>
             <li><a href="https://www.ncsc.gov.uk/blog-post/let-them-paste-passwords">"Let them paste passwords", from the UK's National Cyber Security Centrea>li>
+            <li><a href="https://pages.nist.gov/800-63-4/sp800-63b.html">NIST SP 800-63 Digital Identity Guidelines (Second Public Draft of Revision 4) / SP 800-63B Authentication & Authenticator Managementa>li>
         ul>
 
     section>

understanding/22/accessible-authentication-minimum.html

@@ -174,6 +174,7 @@ Resources
             <li><a href="https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API">Web Authentication API on MDNa>li>
             <li><a href="https://en.wikipedia.org/wiki/OAuth">OAuth on Wikipediaa>li>
             <li><a href="https://www.ncsc.gov.uk/blog-post/let-them-paste-passwords">"Let them paste passwords", from the UK's National Cyber Security Centrea>li>
+            <li><a href="https://pages.nist.gov/800-63-4/sp800-63b.html">NIST SP 800-63 Digital Identity Guidelines (Second Public Draft of Revision 4) / SP 800-63B Authentication & Authenticator Managementa>li>
         ul>
     section>