docs: fix RST format

Author: kenjis

user_guide_src/source/concepts/security.rst

@@ -198,6 +198,7 @@ Preventing injection requires keeping data separate from commands and queries:
 - The preferred option is to use a safe API, which avoids using the interpreter
   entirely, provides a parameterized interface, or migrates to Object Relational
   Mapping Tools (ORMs).
+
     - Note: Even when parameterized, stored procedures can still introduce SQL
       injection if PL/SQL or T-SQL concatenates queries and data or executes hostile
       data with EXECUTE IMMEDIATE or exec().
@@ -206,6 +207,7 @@ Preventing injection requires keeping data separate from commands and queries:
   mobile applications.
 - For any residual dynamic queries, escape special characters using the specific
   escape syntax for that interpreter.
+
     - Note: SQL structures such as table names, column names, and so on cannot be
       escaped, and thus user-supplied structure names are dangerous. This is a
       common issue in report-writing software.