docs: add about Deserialization of Untrusted Data in old() to changelogs/v4.1.6.rst

Author: kenjis

user_guide_src/source/changelogs/v4.1.6.rst

@@ -9,6 +9,11 @@ Release Date: Not released
     :local:
     :depth: 2
 
+SECURITY
+========
+
+- *Deserialization of Untrusted Data* found in the ``old()`` function was fixed. See the `Security advisory <https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-w6jr-wj64-mc9x>`_ for more information.
+
 BREAKING
 ********