Resolve #2476 by rearranging input validation requirements

[tghosth]

This Pull Request relates to issue #2476

[elarlang]

Attempt 416 to get it done :)

Tags - all MODIFIED, SPLIT FROM should be ADDED, SPLIT FROM.

11.3.1 and 11.3.2

• I don't think "will be made" is correct form, "are made"?
• For L2 - "should" vs "must"?

In general - for this kind of change it is better for trackability to make one move (commit) at a time.

[elarlang]

This one also?

V5.6.2 Verify that the application is designed to enforce input validation at a trusted service layer. While client-side validation improves usability, it must not be relied upon as a security control.

[tghosth]

@elarlang I updated the PR.

Once we have finalised the content, I may consider doing a different PR with the changes better organized as separate commits.

[tghosth]

Replaced by #2490