fix(onboarding): clarify security PRs are not part of limits (#45215)

As it wasn't clear before that they would bypass limits.

Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>

Author: jamietanna