CLI server: document eliminating symlink docroot escape in UPGRADING

Author: DanielEScherzer

UPGRADING

@@ -549,6 +549,8 @@ PHP 8.6 UPGRADE NOTES
     method instead of returning 501 Not Implemented.
   . The built-in development server no longer reflects the "Host" header from
     requests.
+  . The built-in development server no longer allows escaping the document root
+    by following symlinks.
 
 ========================================
 4. Deprecated Functionality