Add comment explaining actions.yml

This was added earlier in #162
but didn't survive the `actions.yml` update in 3222bfc

Now that we updated to ruyaml in
#169 I think
comments should be preserved

Author: raboof

actions.yml

@@ -1,3 +1,8 @@
+# Main configuration file. We manually add trusted actions here.
+# Version updates can be triggered by merging dependabot PRs
+# into .github/workflows/dummy-workflow.yml . This will also
+# update expiry dates for previous versions.
+# Versions that are known to be problematic should be removed explicitly manually.
 1Password/load-secrets-action:
   581a835fb51b8e7ec56b71cf2ffddd7e68bb25e0:
     expires_at: 2025-08-01