Clarify in the docs that RequestSanitizer should not be depended on for security

Problem/Motivation

I think if you are looking at RequestSanitizer with docblocks like:

Strips dangerous keys from user input.

We shouldn't send the message that user input in the request object is actually safe (or safer?) or sanitized. While this may sanitize the exact class of injection for SA-CORE-2018-002, other classes of exploit wont (and shouldn't) be filtered here.

Proposed resolution

Clarify in the docs (or name of class/method) that RequestSanitizer is not general sanitization/protection/security.

Remaining tasks

User interface changes

API changes

Data model changes