add application note in SAR about TOE "suitable for testing"

[jeffblank]

We want to ensure that the applicaiton is not obfuscated or packed, as this disrupts the ability to analyze its contents such as API calls etc.