Add security note to URLLoaderFactoryParams

For instance, kBrowserProcessId allows for access to file:// urls and
other urls, effectively allowing user data to be read and sent to the
network.

Change-Id: Iabbb9cdd56061a689c35f4b84550a78a4eed9957
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2429871Reviewed-by: Matthew Denton <mpdenton@chromium.org>
Commit-Queue: Alex Gough <ajgo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#810602}

services/network/public/mojom/network_context.mojom

@@ -605,6 +605,9 @@ enum TrustTokenRedemptionPolicy {
 struct URLLoaderFactoryParams {
   // Process requesting the URLLoaderFactory.
   // Set to kBrowserProcessId to indicate the browser process.
+  //
+  // SECURITY NOTE: Factories with kBrowserProcessId should not be sent
+  // to untrustworthy processes.
   int32 process_id = kInvalidProcessId;
 
   // If specified, then |request_initiator_origin_lock| locks