docs: correct ALLOW_LOCALNETWORKS description in app.example.ini (#39240)

Fixes the `app.example.ini` half of #39224.

The comment says:

> If a domain is allowed by `ALLOWED_DOMAINS`, this option will be
ignored.

That is no longer true. `checkByAllowBlockList` in
`services/migrations/migrate.go` consults the block list **first** and
returns immediately:

```go
if blockList.MatchHostName(hostName) || ipBlocked {
    return &git.ErrInvalidCloneAddr{Host: hostName, IsPermissionDenied: true}
}
// if we have an allow-list, check the allow-list before return to get the more accurate error
if !allowList.IsEmpty() { ... }
```

`IsMigrateURLAllowed` resolves the host with `net.LookupIP` and passes
the addresses in, so with `ALLOW_LOCALNETWORKS = false` a host that
appears in `ALLOWED_DOMAINS` is still rejected once any resolved address
is private or loopback — the allow list never gets a look. The reporter
traced this to the validation hardening in #38324 / #38400, and the code
matches their description.

The new wording states the precedence rather than the old override
claim.

Scope: this only covers `custom/conf/app.example.ini`, which lives here.
The same stale sentence is on the config cheat sheet in `gitea/docs`
(both the English and zh-cn pages) per the issue; that is a separate
repository.

Assisted-by: Claude, via Claude Code

custom/conf/app.example.ini

@@ -2803,7 +2803,8 @@ LEVEL = Info
 ;BLOCKED_DOMAINS =
 ;;
 ;; Allow private addresses defined by RFC 1918, RFC 1122, RFC 4632 and RFC 4291 (false by default)
-;; If a domain is allowed by ALLOWED_DOMAINS, this option will be ignored.
+;; When false, migration URLs are rejected if any resolved address is private or loopback,
+;; even when the host matches ALLOWED_DOMAINS: the block list is applied before the allow list.
 ;ALLOW_LOCALNETWORKS = false
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;