docs(security): add security doc

WIP
We need to be more specific here. Make a few points about:

- not mixing client and server templates (you have it below but it really belongs here),
- do not accept user input and use it to generate templates dynamically
- do not take user input and run it through $scope.$eval
- consider using CSP (but do not rely only on CSP). 

Is there more?