Child windows do not inherit FLAG_SECURE from parent windows, and
therefore, the default dialogs for JS callbacks do not have this flag
even when the app window has it.
This CL adds a note warning about this behavior to mitigate the
potential vulnerability.
Bug: 120086187
Test: m -j offline-sdk-docs seems not broken
Change-Id: I12f12befd1f303d26ebc866f4817f5184279caeb