Document key rotation instructions

PiperOrigin-RevId: 875160177

Author: sfreilich

.github/workflows/bazel-test.yaml

@@ -32,6 +32,12 @@ jobs:
         disk-cache: true
         repository-cache: true
         external-cache: true
+        # This is maintined internally by the Ink Team at Google and requires periodic rotation
+        # of these credentials. Googler admins can update the credentials by going to
+        # https://console.cloud.google.com/iam-admin/serviceaccounts?project=ink-open-source
+        # deleting the expired key, creating a new key in JSON format, and updating the secret in
+        # https://github.com/google/ink/settings/secrets/actions. (Follow the corresponding
+        # instructions for google/ink-stroke-modeler at the same time.)
         google-credentials: ${{ secrets.GOOGLE_CREDENTIALS }}
 
     - name: Test