Currently there is one permissions policy for Topics API:

• Permissions-Policy: browsing-topics

Because it is now possible to retrieve topics without modifying state (#80) there are now two applicable permissions: one for retrieving existing topics, and one for observing topics. Keep the existing Permissions-Policy for compatibility, and document that it will allow both retrieve and observe, and also add new policies that cover retrieve and observe only.

• Permissions-Policy: browsing-topics
• Permissions-Policy: browsing-topics-retrieve
• Permissions-Policy: browsing-topics-observe

Related: #54

Also possibly related: #118 (If URL path and page content can be used as input to the classifier, make it a separate permission)

Related: #206 (a title Permissions-Policy option could also fix that issue)

(edited to match "observe" flag in #80, thanks to @patmmccann for comment)