Readme update -mark_safe usage in admin views

[andrewgy8]

We received a security report in #214 (attached below) flagging the use of mark_safe() in TaskAdmin for rendering message details and tracebacks. The concern is that if task arguments or exception messages contain untrusted user input, this could be a stored XSS vector when viewed in the Django admin.

Assessment

This is a valid use case for mark_safe. We're rendering structured data inside <pre> tags in a trusted admin-only context. The risk is low for most deployments since the Django admin is restricted to staff users. That said, applications that process untrusted input through Dramatiq tasks (e.g. webhook payloads, user-submitted data) could be affected.

Proposed approach

Rather than changing the library's default behavior, this PR:

1. Adds a security notice to the README disclosing the mark_safe usage
2. Provides a workaround showing how to override TaskAdmin with a SafeTaskAdmin that uses format_html() to auto-escape interpolated values

If this turns out to be a common concern, we can merge the workaround into the codebase as the default behavior in a future release.

WDYT?
django-dramatiq-security-disclosure.md