chore: update documentation about IP list (#9579)

The GitHub automatic IP allow list does not work yet completly even
if GitHub UI show our app.

This change explains what to do.

Author: sileht

src/content/docs/security.mdx

@@ -225,3 +225,9 @@ Mergify services use the following IP addresses:
 - 34.121.26.35/32
 - 34.45.103.142/32
 - 34.69.118.185/32
+
+:::note
+Even though these IP addresses will appear in the GitHub allow list as "Managed by Mergify GitHub App",
+they must be manually added to the list by an organization administrator.
+GitHub does not allow OAuth authentication to our dashboard if IPs have not been manually added to the list.
+:::