Clarify security; state that [] is undefined behaviour

[rvedotrc]

Port of #4007 to v3.0.4-dev

[handrews]

Oh I didn't see that there is a 3.1.1 that we're doing before this 3.0.4?

This is why we don't usually post the same fix to multiple branches at once- it's too confusing when there are a lot of notifications. We usually do the oldest branch, and then after that is accepted and merged we post any forward-port PRs.

[rvedotrc]

That's why this is a draft.

[rvedotrc]

Oh I didn't see that there is a 3.1.1 that we're doing before this 3.0.4?

We can merge them in whatever order you like. I have three PRs open (two of which are draft), with essentially identical content. The discussion is mostly happening on the one for v3.1.1-dev, but that wasn't a deliberate decision; it is simply a result of me still getting to grips with the different branches we have, and how things are done.

[handrews]

In today's TDC we agreed to re-try this based on @mikekistler 's "open world" view, so closing these three attempts.

@rvedotrc thank you for your contributions here- it is far from the first topic where we've had to go through multiple approaches, attempts, and PRs. Regardless of who writes the final PR, this has helped us immensely in figuring the problem out.