fixup! fix(@angular/ssr): support '*' in allowedHosts and warn about security risks

Author: alan-agius4

packages/angular/ssr/src/app-engine.ts

@@ -98,7 +98,8 @@ export class AngularAppEngine {
       // eslint-disable-next-line no-console
       console.warn(
         'Allowing all hosts via "*" is a security risk. This configuration should only be used when ' +
-          'validation for "Host" and "X-Forwarded-Host" headers is performed in another layer.',
+          'validation for "Host" and "X-Forwarded-Host" headers is performed in another layer, such as a load balancer or reverse proxy. ' +
+          'For more information see: https://angular.dev/best-practices/security#preventing-server-side-request-forgery-ssrf',
       );
     }