[Yaml] Add notes about unsafe PARSE_* flags for yaml

[nicolas-grekas]

Parsing ``!php/object`` tags uses PHP deserialization internally. Never
enable ``PARSE_OBJECT`` for untrusted YAML contents.

and

Enabling ``PARSE_CONSTANT`` allows YAML contents to resolve arbitrary PHP
constants and enum cases. Only enable it for trusted input.

[javiereguiluz]

These are important tips. Thanks Nicolas!