docs: clarify allowlist entry limits

[sylvesterkaczmarek]

Summary

Clarify that Fence has different 64-entry counting semantics for the native multiline Action input and the advanced JSON configuration.

Problem

The public docs currently say an allowlist may contain 64 unique entries and that duplicates count only once, then describe the advanced JSON config input as having the same 64-entry limit.

That is accurate for the native multiline input, which normalizes and deduplicates before enforcing its unique-entry limit. The advanced JSON path intentionally rejects an allowlist array with more than 64 physical entries before normalization, so duplicate JSON entries still consume the limit.

Evidence / reproduction

• In action/lib.cts, the native multiline parser canonicalizes each allowance, tracks it in a Set, and enforces the limit only when a new unique canonical entry would be added. Repeated or equivalent native lines therefore do not consume additional slots.
• The advanced JSON path first requires parsed.allowlist.length <= 64. That check is on the physical array length, before allowance normalization/deduplication.
• Existing action/test.cts coverage reflects both contracts: the native-input tests verify canonical duplicates count once, while the raw JSON configuration test verifies a 65-element array is rejected.
• Minimal reproduction: provide the same valid destination 65 times through native multiline allowlist; it normalizes to one entry. Put the same allowance object 65 times in advanced JSON config; validation rejects the array for exceeding 64 entries.
• The previous wording in docs/allowlist.md says duplicates count only once and immediately notes that advanced JSON also has a 64-entry limit, which naturally implies the same counting semantics even though the implementation and tests say otherwise.

This PR changes only the documentation so each public input describes the limit it already enforces.

Change

• identify the 64-unique-entry rule as the native multiline input behavior
• document that advanced JSON accepts at most 64 physical array entries before deduplication
• keep the README summary consistent with the detailed allowlist guide

Documentation only; no input-validation or policy behavior changes.