Doc: prevent XSS via args

[makenowjust]

An external name of method arg is not HTML-escaped (and missing quotes even if needed!) We can do XSS by this easily. In addition, typeof restriction is not HTML-escaped, we can also do XSS by this.

For example crystal docs against following code:

module Foo
  def meth("<b>foo bar</b>" baz : typeof("<b>fizz</b>") = "<b>buzz</b>")
  end

  macro mac("<b>foo bar</b>" baz = "<b>fizz</b>")
  end
end

Before:

After:

Thank you.

[sdogruyol]

Thank you @makenowjust 👍