Update ImageDecoder interface documentation for untrusted data

Change-Id: I0482302dcb63fcf260743d1eb5fe471030a01534
Reviewed-on: https://chromium-review.googlesource.com/c/1250201Reviewed-by: Sky Malice <skym@chromium.org>
Reviewed-by: Filip Gorski <fgorski@chromium.org>
Commit-Queue: Brandon Wylie <wylieb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#596388}

components/image_fetcher/core/image_decoder.h

@@ -19,7 +19,9 @@ namespace image_fetcher {
 
 using ImageDecodedCallback = base::Callback<void(const gfx::Image&)>;
 
-// ImageDecoder defines the common interface for decoding images.
+// ImageDecoder defines the common interface for decoding images. This is
+// expected to process untrusted input from the web so implementations must be
+// sure to decode safely.
 class ImageDecoder {
  public:
   ImageDecoder() {}