Update security-interface.txt

Clarify: injected js must come from trusted sources.