Security warnings

[DemiMarie]

Proposed changes

Nginx has various security limitations:

• Modules that proxy to upstream servers (HTTP/1.x, FastCGI, uwsgi, SCGI) assume that the upstream server is trusted
• Modules that set headers, trailers, URLs, or request methods do not check that the result is valid.

Checklist

Before creating a PR, run through this checklist and mark each as complete:

• I have read the contributing guidelines.
• I have signed the F5 Contributor License Agreement (CLA).
• If applicable, I have added tests that prove my fix is effective or that my feature works.
• If applicable, I have checked that any relevant tests pass after adding my changes.
• I have updated any relevant documentation (README.md and/or CHANGELOG.md).

[pluknet]

While I generally support the idea to explicitly document a concept of trusted backends (and other similar origins) to address the progressively decreasing entry level, this should be done is a more correct and fine-grained way, avoiding bold / unsubstantiated statements and other FUD.
Also, the nginx reference documentation is not a bug-tracker or Beginner's guide, something more concise should be enough.

I will keep it open in order to not forget to do this properly.