add some docs regarding security

[bbrehm]

This adds some clarifications regarding security goals. Big thanks to https://github.com/xavierpinho ❤️ for mentioning that here https://github.com/joernio/flatgraph/security/advisories/GHSA-jqmx-3x2p-69vh

Any improvement / rewording ideas?

[xavierpinho]

Thanks for the prompt discussion and clarifications!

Just a typo (double negation) I spotted:

nor should (not/it) cause

[mpollmeier]

Suggested change

	If you do decide against our recommendation to write your own code to "sanity check" potentially malicious `.fg` files before attempting to deserialize them, then we'd be happy for your feedback and PRs. (also beware of potential parser differentials -- e.g. the manifest json can be reached either via the offset from the file header, or via `tail -n 1`, and these may very well be different manifests)
	You should always sanity check potentially malicious `.fg` files before attempting to deserialize them. If there's anything we can add in flatgraph's Deserializer, we'd be happy for your feedback and PRs.
	N.b. also beware of potential parser differentials -- e.g. the manifest json can be reached either via the offset from the file header, or via `tail -n 1`, and these may very well be different manifests.

[bbrehm]

No. Our recommendation is to not bother with sanity checks, and do sandboxing instead.

[mpollmeier]

Your initial text says "our recommendation to write your own code to "sanity check" potentially malicious .fg files", which I interpret as 'we do recommend to write code to sanity check.

But yes, fair enough, will provide a new suggestion based on the current version.

[mpollmeier]

ah, you already updated that part - thanks!