Add comment to xml_reader visibility list

Clarify that //components/trusted_vault only consumes trusted data from Google
origins for which we have static public key pinning.

Bug: 399818721
Change-Id: I04b22fb8c65a4bae27f54d1b002e51bc23995e2b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6473482
Commit-Queue: Daniel Cheng <[email protected]>
Auto-Submit: Martin Kreichgauer <[email protected]>
Reviewed-by: Daniel Cheng <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1449107}
NOKEYCHECK=True
GitOrigin-RevId: 51fbbd31a09a7bc3f2c5e947f5e2d1fc7b1b49f8
1 file changed