ci: adopt the template's zizmor policy comment

The go-app template reworded this comment in netresearch/.github@00f5783
to cover composite actions as well as reusable workflows. The consumer
was not synced, so the template-drift check has failed on main since
that landed. Only the comment differs; the policies are unchanged.

Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>

Author: CybotTM

.github/zizmor.yml

@@ -6,8 +6,9 @@ rules:
   unpinned-uses:
     config:
       policies:
-        # First-party reusable workflows track @main by policy and are
-        # never SHA-pinned, so fixes propagate to all consumers.
+        # First-party `uses:` — reusable workflows AND composite actions —
+        # track @main by policy and are never SHA-pinned, so a fix propagates
+        # to every consumer without a bump in dozens of repos.
         "netresearch/*": ref-pin
         # Everything else must be pinned to a full commit SHA.
         "*": hash-pin