Since the introduction of `vars` to GitHub Actions, I started using that
instead of the "environments" trick I used in Packager. However, it has
become clear now that the `vars` strategy has major drawbacks, such as
requiring the use of `pull_request_target`, which should only be used
for actions that do not execute PR-author-controlled code.
This updates the comments to clarify why this is used. This reusable
settings workflow will also be deployed now in other repos to
standardize on this "environments" mechanism, which is safer than
`vars`.
