docs(security): security api doc update and fix stability marker for Type

modules/@angular/compiler/src/runtime_compiler.ts

@@ -30,6 +30,10 @@ import {InterpretiveAppViewInstanceFactory} from './output/interpretive_view';
  * An internal module of the Angular compiler that begins with component types,
  * extracts templates, and eventually produces a compiled version of the component
  * ready for linking into an application.
+ *
+ * @security  When compiling templates at runtime, you must ensure that the entire template comes
+ * from a trusted source. Attacker-controlled data introduced by a template could expose your
+ * application to XSS risks.  For more detail, see the [Security Guide](http://g.co/ng/security).
  */
 @Injectable()
 export class RuntimeCompiler implements ComponentResolver, Compiler {

modules/@angular/compiler/src/url_resolver.ts

@@ -42,6 +42,11 @@ export var DEFAULT_PACKAGE_URL_PROVIDER = {
  * ## Example
  *
  * {@example compiler/ts/url_resolver/url_resolver.ts region='url_resolver'}
+ *
+ * @security  When compiling templates at runtime, you must
+ * ensure that the entire template comes from a trusted source.
+ * Attacker-controlled data introduced by a template could expose your
+ * application to XSS risks. For more detail, see the [Security Guide](http://g.co/ng/security).
  */
 @Injectable()
 export class UrlResolver {