docs(acl): correct the Browse override's 'two namespace root folders' remark — one shared anchor

The XML remark above OtOpcUaNodeManager.Browse still carried the exact claim the
security.md correction in 22ae1836 removed: there is ONE shared root folder
(V3NodeIds.SharedRootFolderId, raw namespace) fronting both realm trees, not one
per namespace. Rewritten to name the anchor, the ns=0 listing behaviour, and the
zero-segment realm-root mapping that now admits transit holders.

Also completes the BuildScope collision remark (code-review Minor): the degenerate
raw folder literally named OtOpcUa loses the accidental grant leak onto the
anchor's Read/Write that the old one-segment scope allowed — a narrowing,
fail-closed side effect, now recorded.

Comment-only change; addresses the code review's sole Important + Minor.

src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/Security/DataPlaneAuthorizer.cs

@@ -369,7 +369,10 @@ public sealed class DataPlaneAuthorizer
     ///         literally named <c>OtOpcUa</c> would already mint the identical NodeId as the anchor in the
     ///         served address space itself (<c>EnsureFolder</c> takes the RawPath as the id), so the
     ///         collision — if an operator ever authors one — predates this mapping and lives in the address
-    ///         space rather than in the gate.
+    ///         space rather than in the gate. One narrowing side effect in that degenerate case: a grant
+    ///         scoped to the colliding folder used to leak onto the anchor's own Read/Write (the old
+    ///         one-segment scope descended into it); the zero-segment scope no longer does, which is the
+    ///         fail-closed direction.
     ///     </para>
     /// </remarks>
     /// <param name="identifier">The node's non-empty <c>s=</c> identifier.</param>