doc: xss_clean() method is in Security, not Input

The Input doc does talk about xss filtering, but they refer you to Security for details, which is where the function is actually defined.  It gives more detail about what the function is supposed to do, and avoids some irrelevance.

It's probably not a big deal; it just looks wrong.  It _might_ have been responsible for confusion[1] sometimes.

[1] http://stackoverflow.com/questions/13570522/this-input-xss-cleandata-giving-fatal-error-with-codeigniter