Most of this section was written from the time that render file: was the
default, before CVE-2016-0752.

This updates the guide to the Rails 6 `render file:` behaviour, moves it
to a more appropriate part of the file.

[ci skip]