chore: Update webpack.config.js (#1153)

Add a cautionary comment about `devServer` being a security problem.

## References
GHSA-wr3j-pwj9-hqq6

Author: wraithgar

webpack.config.js

@@ -1,4 +1,6 @@
 const {resolve} = require('path')
+// XXX do not export a devServer from this file.
+// See https://github.com/advisories/GHSA-wr3j-pwj9-hqq6 for more info.
 module.exports = {
   resolve: {
     alias: {