docs: document security issues around untrusted .git dirs