Adds comment about the security of TypeNameHandling.All

src/SignalR/server/SignalR/test/HubConnectionHandlerTests.cs

@@ -3595,6 +3595,10 @@ namespace Microsoft.AspNetCore.SignalR.Tests
                 {
                     PayloadSerializerSettings = new JsonSerializerSettings()
                     {
+                        // The usage of TypeNameHandling.All is a security risk.
+                        // If you're implementing this in your own application instead use your own 'type' field and a custom JsonConverter
+                        // or ensure you're restricting to only known types with a custom SerializationBinder like we are here.
+                        // See https://github.com/aspnet/AspNetCore/issues/11495#issuecomment-505047422
                         TypeNameHandling = TypeNameHandling.All,
                         SerializationBinder = StreamingHub.DerivedParameterKnownTypesBinder.Instance
                     }