docs(security): credential-reference namespaces + migration note (#815)

docs/security.md gains the canonical table of per-driver namespaces, the five
enforcement seams, the out-of-scope cases (appsettings ${secret:}, Sql
connectionStringRef) and the migration steps for existing configs. Galaxy,
OpcUaClient, Heidenhain, Configuration and driver-specs docs, the Galaxy
options XML docs, the drivers rule file and the docker-dev compose comment
point at it. docker-dev's env:GALAXY_MXGW_API_KEY stays valid (allowed legacy
prefix), so no rig change is needed.

Co-Authored-By: Claude <noreply@anthropic.com>

docs/v2/driver-specs.md

@@ -51,7 +51,7 @@ Per `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Galaxy/Config/GalaxyDriverOptions.cs`:
 {
   "Gateway": {
     "Endpoint": "http://localhost:5120",
-    "ApiKeySecretRef": "secret:galaxy-gw-api-key",
+    "ApiKeySecretRef": "secret:galaxy/gw/apikey",
     "UseTls": true,
     "CaCertificatePath": null,
     "ConnectTimeoutSeconds": 10,