ssh - document concerns with LocalForward (#87035)

* Add docs indicating that LocalFoward along with the defaults can lead to an insecure config

lib/ansible/plugins/connection/ssh.py

@@ -19,8 +19,9 @@ DOCUMENTATION = """
         - connection_pipelining
     version_added: historical
     notes:
-        - This plugin is mostly a wrapper to the ``ssh`` CLI utility and the exact behavior of the options depends on this tool.
-          This means that the documentation provided here is subject to be overridden by the CLI tool itself.
+        - This plugin is mostly a wrapper to the C(ssh) CLI utility and the exact behavior of the options depends on this tool.
+        - The documentation provided here is subject to be overridden by configurations of C(ssh) itself.
+        - External configurations of the C(ssh) client CLI can lead to insecure configurations.
         - Many options default to V(None) here but that only means we do not override the SSH tool's defaults and/or configuration.
           For example, if you specify the port in this plugin it will override any C(Port) entry in your C(.ssh/config).
         - The ssh CLI tool uses return code 255 as a 'connection error', this can conflict with commands/tools that
@@ -92,7 +93,9 @@ DOCUMENTATION = """
               - name: ansible_sshpass_prompt
           version_added: '2.10'
       ssh_args:
-          description: Arguments to pass to all SSH CLI tools.
+          description: Arguments to pass to all SSH CLI tools. The use of C(LocalForward)/C(-L)
+                       along with the default C(-C) can lead to an insecure configuration. Ensure
+                       these options are not used in combination.
           default: '-C -o ControlMaster=auto -o ControlPersist=60s'
           type: string
           ini: