docs(fix): note that action secrets are unavailable to just prs from forks

[zimeg]

Summary

👋 This PR adds some nuance to how tokens can be accessed in workflows since PRs might use the secrets if not configured otherwise - forked PRs instead have no access to secrets at all!

Preview

Some testing in this PR shows pushes to the cache from the Post Setup cachix caches step in the first run:

[2024-06-28 03:47:53][Info] Starting Cachix Daemon
...
[2024-06-28 03:48:37][Info] Pushing /nix/store/2x604xn8hs4qlba5ai6k0d4qsvj422p4-etime-1.0.1
[2024-06-28 03:48:40][Info] Pushed /nix/store/2x604xn8hs4qlba5ai6k0d4qsvj422p4-etime-1.0.1

I found that the following can be used to skip pushing cache updates on pull requests if that's preferred too:

        - name: Setup cachix caches
+         if: github.event_name != 'pull_request'
          uses: cachix/cachix-action@v15

Open to updating this with whatever changes! Thank you for a cool cache! 🙏