Update docs on secure env vars to clarify pull request availability

Secure environment variables are available if the pull request comes
from the same repository.