docs(security): add security doc

WIP
"who can edit the template before it's processed by Angular."