docs: clarify + improve Workflow Restrictions page

[agilgur5]

Motivation

A number of people, including me, have been confused by the ambiguous language on this page.

• This popped up recently on Slack, so I dove into the codebase to verify the behavior in order to be able to clarify the docs

Modifications

• clarify what Secure means by "between operations" and "enforce"

  • see current Workflow Restrictions feature code, specifically, MustNotChangeSpec function
  • if a Workflow MustNotChangeSpec, then it will be marked as errored if its underlying WorkflowTemplate changes during execution
    • marking the Workflow as errored stops it

• clarify that Secure is a superset of Strict by rewording to say "Same as Strict plus [...]"

  • MustUseRference checks for either Secure or Strict
  • remove duplicate language on arbitrary Workflows that was uniquely worded and made it seem like Secure acted differently (it does not other than the one additional feature)
  • change the example to use Strict because it only uses that feature and does not specify a reason to use Secure
    • makes it less confusing about that the overlap. Secure is a strict superset
    • also add a colon after the example intro

• clarify the word "limiting" by instead saying "disallowing"

  • with templateRestrictions, you must use a workflowTemplateRef with no exceptions

• use simpler and more direct language, per k8s style guide

• use active voice, per k8s style guide

• consistently refer to the reader as "you", per k8s style guide

  • previously the doc referred to the admin as you initially, but then refers to the admin again in third-person
  • also consistently use "users" instead of "users" and then "operators", which made it very ambiguous who the subject was

Verification

n/a

[agilgur5]

Unrelated unit test failure. If that's a flake, I actually haven't seen that one before -- might be an actual race error, but not sure as the test diff is really hard to read.

Will need a CI retry 😕

[agilgur5]

Unit test failure should have been fixed by #11816, so merged master

[agilgur5]

ah I need to merge master for the new required composite E2E check from #12006 to run