cmd/cue: document that embedding is limited to files in the same module

Fixes #3788.

Signed-off-by: Daniel Martí <[email protected]>
Change-Id: I64d2816d45b2259309d1046b4b2e064c8a7688c3
Reviewed-on: https://review.gerrithub.io/c/cue-lang/cue/+/1214899
TryBot-Result: CUEcueckoo <[email protected]>
Unity-Result: CUE porcuepine <[email protected]>
Reviewed-by: Roger Peppe <[email protected]>

Author: mvdan

cmd/cue/cmd/help.go

@@ -252,6 +252,9 @@ Files containing multiple documents cannot be embedded directly.
 For NDJSON or multi-document YAML files, embed as type=text
 and use APIs like yaml.Extract to decode as a list.
 
+For security reasons, only files contained in the same module
+can be embedded. Embedding is forbidden when outside a module.
+
 Note that embedding CUE files is not supported at this time.
 
 For the time being, embedding support can still be disabled via