docs(zizmor): describe the rule that is actually enforced

The comment above the unpinned-uses policy said netresearch-owned reusables
"track @main by policy and are never SHA-pinned". zizmor does not check which
ref is used — ref-pin accepts any branch or tag, and the @main convention is
ours, not the rule's. Reworded so the comment matches what the policy below
enforces.

Synced from netresearch/.github#336.

Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>

Author: CybotTM

.github/zizmor.yml

@@ -7,8 +7,10 @@ rules:
     config:
       policies:
         # First-party `uses:` — reusable workflows AND composite actions —
-        # track @main by policy and are never SHA-pinned, so a fix propagates
-        # to every consumer without a bump in dozens of repos.
+        # are ref-pinned rather than SHA-pinned: a branch or a tag, in practice
+        # @main. That is what lets a fix reach every consumer without a bump in
+        # dozens of repos. The rule below enforces the ref-vs-SHA distinction;
+        # which ref is convention, not something zizmor checks.
         "netresearch/*": ref-pin
         # Everything else must be pinned to a full commit SHA.
         "*": hash-pin