Mention that the Isolation property listed in the readme is not a security property

Hello,

Following discussions on IRC, I've been pointed to this crate. It looks great!

That said, there is a thing that is listed in the readme, and, I think, has been misinterpreted by some: the `Isolation` property does not protect against a malicious proc macro, only against a buggy proc macro.

It doesn't protect against an actively malicious proc macro, because just wrapping the malicious code in `quote!{}` and returning it alongside the token streams would be enough to bypass any isolation properties of wasm -- except if the built code is never run locally, even just for `cargo test`.

As such, I think it may be helpful to just add a sentence to the readme stating that this isolation property does not protect against actively malicious proc macros?

Start in the README at the section describing the Isolation property and review the surrounding wording about procedural macros and WebAssembly. Add a clear caveat that isolation protects against buggy, but not actively malicious, proc macros; no test is mentioned, so done means the warning is accurately and visibly documented.

Written by the indexing model from the issue text.