Apple has updated the documentation some time in the last week. The location is now spelled out in these pages:
Adding a privacy manifest to your app or third-party SDK (new page)
https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/adding_a_privacy_manifest_to_your_app_or_third-party_sdk
Placing content in a bundle:
https://developer.apple.com/documentation/bundleresources/placing_content_in_a_bundle
For static libraries, see section "Distribute your static library with a privacy manifest"
https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/adding_a_privacy_manifest_to_your_app_or_third-party_sdk#4336752