fix(garage): a comment in the ConfigMap tripped Trivy's KSV-0109

Run 446 reported one HIGH finding, and it was prose, not data: the line
"metrics_require_token = true plus a token to close it" sits inside the
ConfigMap's data block, and KSV-0109 reads a <key> = <value> assignment with a
credential-ish key name as a stored secret - comments included. The ConfigMap
holds no credential at all; the RPC secret arrives as an environment variable
precisely so that it cannot.

Reworded rather than excepted: an entry in ci/trivy/trivyignore.yaml would
carry a permanent exception for one sentence, and the next reader of the report
would have to re-establish that the ConfigMap really is secret-free. The
replacement names the mechanism at the line, so the shape does not come back.

garage/templates/garage.configmap.yaml

@@ -153,10 +153,16 @@ data:
     # WHAT IS AND IS NOT REACHABLE AS A RESULT, stated precisely because "no
     # token" reads like "nothing is open":
     #   /health   open, by design, and the probes depend on it
-    #   /metrics  OPEN TOO - metrics_require_token defaults to false, so with
-    #             no metrics_token the endpoint needs no authentication. That
-    #             is internal metrics on a ClusterIP port; set
-    #             metrics_require_token = true plus a token to close it.
+    #   /metrics  OPEN TOO - the metrics_require_token switch defaults to
+    #             false, so without a metrics credential the endpoint needs no
+    #             authentication. That is internal metrics on a ClusterIP port;
+    #             to close it, set that switch true and add a credential.
+    #
+    #             (And a note for whoever edits these lines: do NOT write them
+    #             as "<key> = <value>" with a credential-ish key name. Trivy's
+    #             KSV-0109 reads an assignment inside this ConfigMap's DATA -
+    #             comments included - as a stored secret and reports HIGH. It
+    #             cost one run here, 2026-10-03.)
     #   everything else  401/403 until a token exists. Note that a config
     #             token is not the only way to get one: Garage 2.x also keeps
     #             admin tokens in the cluster ("garage admin-token create"),