[becss] security notice

The BeCSS draft should note somewhere that the 'binding'
property can introduce scripting and, unlike other CSS
properties, may need to be stripped out of user-submitted
content on sites like LiveJournal and weblogs.

~fantasai