Add warning to carefully parse claims

Added a note about treating claim values as potentially attacker provided input.

Author: hannestschofenig

draft-ietf-oauth-rfc8725bis.md

@@ -635,6 +635,7 @@ value is present or none of the values are associated with the recipient, it MUS
 
 ## Carefully Parse Claims {#do-not-trust-claims}
 
+Treat claim values as potentially attacker provided input.
 
  The "kid" (key ID) header is used by the relying application to
  perform key lookup. Applications