docs(drivers): a plugin driver's config is its author's to keep free of credentials (#21927)

Refs #21840

Clause-②: no

## What

One paragraph in `content/docs/data-modeling/drivers.mdx`, after the
note that a plugin-contributed driver's `config` is left unvalidated. It
adds that the platform does not guess which keys of that `config` hold
credentials, that the `config` is stored and served to administrators as
written, and that keeping secrets out of it is the plugin author's
responsibility, with the credential going in the bound secret
(`external.credentialsRef`).

This is the one change the maintainer kept when #21840 was closed as not
planned (ruling on #21921).

## Checks

- `node scripts/check-doc-authoring.mjs`: exit 0.
- Docs only, so nothing is published and no changeset is needed.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_018zT8d8NpiQ1ExhuNd5TxY6

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

content/docs/data-modeling/drivers.mdx

@@ -154,7 +154,10 @@ Two things live **outside** `config`, because they are not driver-specific:
 
 A plugin-contributed driver (`com.vendor.snowflake`) has no contract in this
 repo, so its `config` is left unvalidated rather than judged against a shape the
-platform does not have.
+platform does not have. The platform also does not guess which of its keys hold
+credentials: `config` is stored and served to administrators as written. Keeping
+secrets out of it is the plugin author's responsibility; put the credential in
+the bound secret (`external.credentialsRef`) instead.
 
 <Callout type="info">
 The same schemas are projected to JSON Schema for