Provide flag to define ATTS 'unspecified' LMT behavior

[bretg]

This is a simpler approach to addressing the core concern laid out in #4151 -- allowing app developers to utilize SharedID while respecting explicit privacy signals.

In further discussions with legal counsel, the outcome is that Prebid should continue to respect ATTS values of "restricted" and "denied" even though SharedID is not cross-app. But as defined in #1699 (comment) the ATTS value of "unspecified" also turns on the LMT flag.

So the proposal is to allow an account-level way for publishers to tune this behavior:

privacy:
  atts:
    lmt:
      unspecified: false     // default to true

Maybe someday we might consider allowing publishers to loosen the behavior of restricted, but for now we'd limit it to unspecified.

This changes the logic defined in #1699 (comment) to

...

2. Else if PBS receives a request with the following attributes: app object exists, device.os = “iOS”, device.osv = “14.2” or greater the following requirements apply:
2a. If device.ext.atts = 3, set device.lmt = 0, in the request to bid adapters. ATTS 3 is "authorized"
2b. Else if device.ext.atts = 1 or 2, set device.lmt = 1 in the request to bid adapters. ATTS 1 and 2 are "restricted" and "denied" respectively
2c. Else if device.ext.atts = 0 and privacy.atts.lmt.unspecified=true (the default), set device.lmt = 1 in the request to bid adapters. ATTS 0 is "unspecified"

3. Else, use device.lmt in the request

Note: it should also be possible for a module to override the LMT setting before going to the bid adapters in case the publisher wants to consider other factors such as geo.