Add more info on the new CI permissions model

From discussion in issue https://gitlab.com/gitlab-org/gitlab-ce/issues/22484

See merge request !6843