DOC: Document that read_hdf can use pickle
This documents that `read_hdf`, which uses PyTables, might invoke pickle to deserialize arrays that were serialize with pickle.

PyTables clearly documents this at http://www.pytables.org/usersguide/libref/declarative_classes.html#tables.ObjectAtom, but pandas users may not realize that if they aren't aware that pandas uses pytables under the hood.

I've tried to include the warning in all the methods that eventually read data, but it's a bit hard to say if I've gotten them all.

Ideally we would also like to provide an `allow_pickle=False` keyword, but that would be best implemented in PyTables, and used by us. I opened https://github.com/PyTables/PyTables/issues/813 for discussion.
lgtm ex Jeff's comments FYI, I tagged this for 1.1.1. Wouldn't normally backport doc-only changes but this is tangentially security related so I think it's better to backport. thanks @TomAugspurger 