DOC: Document Remote Code Execution risk for Dataframe.query and computation.eval
## TLDR
This diff adds documentation to the Remote Code Execution risk for `Dataframe.query` and `computation.eval` with the same wording used in [Dataframe.eval](https://github.com/pandas-dev/pandas/blob/v2.2.2/pandas/core/frame.py#L4850-L4852)

## Details
The Dataframe.query function is internally calling Dataframe.eval [here](https://github.com/pandas-dev/pandas/blob/b552dc95c9fa50e9ca2a0c9f9cdb8757f794fedb/pandas/core/frame.py#L4547) passing the `expr` parameter. 
Dataframe.eval is correctly warning in the [documentation](https://pandas.pydata.org/docs/reference/api/pandas.DataFrame.eval.html#pandas.DataFrame.eval) that this could lead to Code execution risk.
This is possible because using the `@` syntax we can access local variables and by referencing the imported pandas library we can get the `os.system` function thanks to `os` being imported inside [compat/__init__.py](https://github.com/pandas-dev/pandas/blob/main/pandas/compat/__init__.py#L13). In this way passing something like `@pd.compat.os.system('whoami')` to the `expr` parameter of `Dataframe.query` we can achieve code execution.

However in Dataframe.query [documentation](https://pandas.pydata.org/docs/reference/api/pandas.DataFrame.query.html) we do not surface this risk we only point out that pandas.eval is called but also [there](https://pandas.pydata.org/docs/reference/api/pandas.eval.html#pandas.eval) we do not warn about any code execution risks. 

The vulnerable code I found and that also surprised the developer who wrote it of the code execution risk can be summarized in UserControlled input flowing into the DataFrame.query expr value similarly to
```
import pandas as pd

def api_whatever(request: HTTPRequest):
  filter = request.GET["filter"]
  data = {
    "test": [125, 230, 412],
  }
  df = pd.DataFrame(data)
  df.query(filter)
   ... 

```
Calling this api with data:
https://www.example.com?filter=@pd.compat.os.system('whoami')
will allow code execution.


Thanks @r0rshark!