docs(reviews): close Driver.Sql-009 + Driver.Sql.Browser-001/002/003

-003 is a documented Won't Fix: the mitigating control is the ConfigEditor page
policy on the only two surfaces that reach a browse session (/raw and /uns),
there is no HTTP endpoint for browse, and PageAuthorizationGuardTests pins both
pages to that exact policy. Recorded in docs/security.md under Control-Plane
Authorization and pointed at from SqlDriverBrowser's class summary.

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser/SqlDriverBrowser.cs

@@ -26,6 +26,13 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser;
 ///     the driver factory would drop it — which makes its presence proof that an operator typed it just now.
 ///     A config carrying both logs a warning (naming the shadowed <em>ref</em>, never any connection text) so
 ///     the override is visible rather than silent.</para>
+///     <para><b>Trust boundary: this is an outbound-connect capability, gated by the AdminUI page policy.</b>
+///     Accepting a literal means dialling an arbitrary host and port — plus whatever the provider's keyword
+///     set allows — from the AdminUI host, before anything is persisted. The control is that the only
+///     surfaces reaching a browse session are <c>/raw</c> and <c>/uns</c>, both
+///     <c>[Authorize(Policy = AdminUiPolicies.ConfigEditor)]</c> (Administrator or Designer), with no HTTP
+///     endpoint for browse at all; the hygiene below is supporting, not the control. Recorded in
+///     <c>docs/security.md</c> §"Address-picker browse is an outbound-connect capability".</para>
 ///     <para><b>Credential hygiene is the point of this type.</b> A connection string is a secret. It is
 ///     passed to the provider and to nothing else: it never reaches a log line, an exception message, a field,
 ///     or anything persisted. Because ADO.NET providers are free to echo connection-string content in their