[Automation API] Add note about how API is private

The Automation API is private but doesn't include 'private'
in the name. Add a note to _manifest_features.json so that
future devs do not unintentionally release it publicly.

Bug: b/262638176
Change-Id: I780c546f0c10206eb31db451a10bf4c56843a177
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5025854
Reviewed-by: Devlin Cronin <rdevlin.cronin@chromium.org>
Commit-Queue: Katie Dektar <katie@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1224379}

extensions/common/api/_manifest_features.json

@@ -40,6 +40,11 @@
     "extension_types": ["platform_app"]
   },
   "automation": {
+    // This is a private API which, for historical reasons, does not include
+    // 'private' in the name. It should not be exposed outside of first-party
+    // allow-listed very trusted extensions and component extensions.
+    // This API has no protection in the JS wrappers around untrusted scripts
+    // putting getters/setters to intercept and manipulate native bindings.
     "channel": "stable",
     "extension_types": ["extension", "legacy_packaged_app", "platform_app"],
     "allowlist": [