Add guide to managing a url orb allow list

[yaningo]

Description

Documenting how to manage URL orb allow-lists.

Reasons

This is a new feature.

Content Checklist

Please follow our style when contributing to CircleCI docs. Our style guide is here: https://circleci.com/docs/style/style-guide-overview.

Please take a moment to check through the following items when submitting your PR (this is just a guide so will not be relevant for all PRs) 😸:

• Break up walls of text by adding paragraph breaks.
• Consider if the content could benefit from more structure, such as lists or tables, to make it easier to consume.
• Keep the title between 20 and 70 characters.
• Consider whether the content would benefit from more subsections (h2-h6 headings) to make it easier to consume.
• Check all headings h1-h6 are in sentence case (only first letter is capitalized).
• Is there a "Next steps" section at the end of the page giving the reader a clear path to what to read next?
• Include relevant backlinks to other CircleCI docs/pages.

[gordonsyme]

I think it would be useful to add a short "how to" section. E.g. if you want to use an orb in a public GitHub repo you need to set the allow-list entry up with the none auth-type.

If you want to use an orb in a private GitHub repo you need to use either github-oauth or github-app.

If a single organisation wants to use orbs from public and private repos it needs to set both entries up, this can mean you have the same URL prefix in the allow-list twice, but with different auth.

Things that might be relevant for the "how to":

• When you should use github-app vs github-oauth for auth. Answer: always prefer github-app unless you don't have CircleCI's GitHub App set up.
• How to work out the URL to use when you host an orb on GitHub. E.g. if the file is orbs/my-orb.yaml in a repo called my-org/my-orbs-repo then you need to use https://raw.githubusercontent.com/my-org/my-orbs-repo/refs/heads/main/orbs/my-orb.yaml. If you want to use a specific commit sha for the orb content the URL looks a bit different again. You can get these from clicking the Raw button when looking at a file on github.com at least.
• Same thing, but for Bitbucket.
• Using both public and private GitHub repos to host URL orbs