doc: better note

.github/workflows/ci.yml

@@ -94,6 +94,10 @@ jobs:
           path: iguana_src
       - name: key
         id: key
+        # FIXME: this builds the source code URL; using the GitHub REST API
+        # (via `curl --request`) is preferred to get the source code URL, but
+        # needs a PAT to mitigate API rate limits; for now just assume the URL
+        # - see https://github.com/JeffersonLab/iguana/pull/276
         run: |
           [ "${{ inputs.verset }}" = "minver" ] && \
             root_version=$(iguana_src/meson/minimum-version.sh root tag) || \
@@ -113,7 +117,7 @@ jobs:
         run: iguana_src/.github/install-dependency-packages.sh ${{ inputs.runner }} ${{ inputs.verset }}
       - name: download ROOT source code
         if: ${{ steps.cache.outputs.cache-hit != 'true' }}
-        run: | # FIXME: prefer GitHub REST API (via `curl --request`) to get the source code URL (needs a PAT to mitigate API rate limits)
+        run: |
           wget -nv --no-check-certificate --output-document root.tar.gz ${{ steps.key.outputs.root_url }}
           tar xf root.tar.gz
           ls -t