Add notes on mitigation for shadowsocks-libev issue

The ss-manager should in any case never be exposed to pubic and anyone
using ss-manager should use unix domain socket path (via
--manager-socket).