docs: clarify that @hidden, @export are not access controls + allowRead trusted-context / filter caveats

docs: clarify that @hidden, @export are not access controls + allowRead trusted-context / filter caveats #483