[3.14] gh-148337: Document importlib.resources security model (GH-148340) (#148356)

gh-148337: Document `importlib.resources` security model (GH-148340)
(cherry picked from commit 70b86e7)

Co-authored-by: Stan Ulbrych <stan@python.org>

Author: miss-islington

Doc/library/importlib.resources.rst

@@ -31,6 +31,12 @@ not** have to exist as physical files and directories on the file system:
 for example, a package and its resources can be imported from a zip file using
 :py:mod:`zipimport`.
 
+.. warning::
+
+   :mod:`importlib.resources` follows the same security model as the built-in
+   :func:`open` function. Passing untrusted inputs to the functions
+   in this module is unsafe.
+
 .. note::
 
    This module provides functionality similar to `pkg_resources