Mention python package index --extra-index-url potential dependency confusion attack in web-ui

[laundmo]

Description

Currently, Gitea suggests using the command pip install --extra-index-url <gitea-url> <packagename>. The --extra-index-url is susceptible to dependency confusion attacks, see: pypa/pip#8606
This suggested command also does not match the documented command which uses the --index-url <gitea-url> --no-deps flags.

This should be mentioned in the web-ui to make users aware of the potential security risks from using this for private packages.

Screenshots

Gitea Version

1.18.3

Can you reproduce the bug on the Gitea demo site?

No

Operating System

No response

Browser Version

Firefox 109.0

[laundmo]

note: i set Can you reproduce the bug on the Gitea demo site? to No because i have not tried to reproduce it.