Merge pull request #6021 from kenjis/fix-docs-model.rst

docs: add note to $allowedFields

Author: kenjis

user_guide_src/source/models/model.rst

@@ -141,6 +141,8 @@ This array should be updated with the field names that can be set during ``save(
 against just taking input from a form and throwing it all at the model, resulting in
 potential mass assignment vulnerabilities.
 
+.. note:: The ``$primaryKey`` field should never be an allowed field.
+
 $useTimestamps
 --------------