docs: add security note for public ASR demos

[alondai]

Summary

Add a short security note to the ASR docs for public demo deployments.

This PR is intentionally limited to documentation. It is meant to complement #263 rather than overlap with its runtime hardening changes.

Changes

• Add a warning in docs/vibevoice-asr.md next to the --share example
• Add a matching note in README.md near the ASR demo links

Why

The current docs make it easy to copy-paste a public Gradio demo launch command, but they do not call out that public uploads and local model artifacts should be treated as untrusted inputs.

This note is meant to reduce accidental unsafe deployments without changing runtime behavior.

Verification

• Reviewed rendered markdown locally
• Confirmed this PR stays docs-only and does not overlap with the runtime hardening work in fix: security hardening — unsafe deserialization, RCE, input validation #263

[alondai]

@microsoft-github-policy-service agree