(docs) fix dangerously misleading warning about browser-side query execution

Client-side query building should come with appropriate warnings.  Saying that the security risk is injection will probably make people think they can secure the system by escaping something somewhere.  It's not, and they can't.