minor #9793 Added a caution note about env vars and the profiler (javiereguiluz)

This PR was submitted for the 4.0 branch but it was squashed and merged into the 3.4 branch instead (closes #9793).

Discussion
----------

Added a caution note about env vars and the profiler

This fixes #9540.

Commits
-------

1c426f7 Added a caution note about env vars and the profiler

Author: javiereguiluz

configuration/external_parameters.rst

@@ -135,6 +135,10 @@ of the following:
     ``kernel.charset`` parameter). These default values are resolved when
     compiling the service container and won't change at runtime once dumped.
 
+    The values of the env vars are also exposed in the web interface of the
+    :doc:`Symfony profiler </profiler>`. In practice this shouldn't be a
+    problem because the web profiler must **never** be enabled in production.
+
 Constants
 ---------