docs: sync the scanner wording from the template

Picks up netresearch/.github#334, which corrects three things a reviewer
raised repeatedly during the rollout: the header named betterleaks while the
job keeps the historical gitleaks name, it called the last job a composer
audit although the reusable also runs an Opengrep SAST scan by default, and
the zizmor comment said the exemption covers reusable workflows when the rule
matches any first-party uses, composite actions included.

Comments only — no job, permission or trigger changes.

Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>

Author: CybotTM

.github/zizmor.yml

@@ -6,8 +6,9 @@ rules:
   unpinned-uses:
     config:
       policies:
-        # First-party reusable workflows track @main by policy and are
-        # never SHA-pinned, so fixes propagate to all consumers.
+        # First-party `uses:` — reusable workflows AND composite actions —
+        # track @main by policy and are never SHA-pinned, so a fix propagates
+        # to every consumer without a bump in dozens of repos.
         "netresearch/*": ref-pin
         # Everything else must be pinned to a full commit SHA.
         "*": hash-pin