I was replying to the question about getting a list of permissions a page uses/wants.
Neither Vibrate nor WebAudio require permissions from the webpage. Like basic JavaScript they always run. They're not security/privacy risks per se, just something that, like so many other things, could be used to support a phishing attack.
Firefox for Android developer here, you can long-tap on the location bar while on the page and select 'Edit Site Settings'. Is that what you're looking for?
That is only used if the API requires user confirmation. So things like geolocation, camera, and microphone access will be shown. Adding the feature from desktop should be a bug already. If not then we should file one.
Some APIs are allowed by default and some aren't. For the discussion about Vibration, see: https://wiki.mozilla.org/WebAPI/Security/Vibration