Minimize security exposures via bot, clarify CLI usage

The current README doesn't clarify usage other than by pointing at the @all-contributors bot ([Bot Overview · All Contributors](https://allcontributors.org/docs/en/bot/overview)).

That bot documentation doesn't note the manifold security implications of adding the bot as a committer to a user's repository. E.g. unless I'm misunderstanding something, by granting "Write access to code" to the bot, if the bot is hacked, all the repos it can update can be hacked. That sounds like a serious issue, and makes you a big target, right?

So I think the README should be updated to point out the CLI, and recommend it, especially for low-churn repos.

And the bot documentation should be changed to warn of the implications.

In fact, couldn't the bot be changed to just create PRs, which must be merged by hand? That would put the security issues back in the hands of the proper maintainers.

See an example of some other security measures you could take and assurances you could provide to users at [renovate/data-security.md at master · renovatebot/renovate](https://github.com/renovatebot/renovate/blob/master/website/docs/data-security.md). Note that they seem talk about some useful protections, but I don't know if they are actually doing things securely, and that depends on lots of things. Security is hard!

GitHub could of course provide more fine-grained permissions so you could be more secure. See e.g. [GitHub's Permission System is Flawed · Issue #113 · dear-github/dear-github](https://github.com/dear-github/dear-github/issues/113). Beyond that, for this project, it would be great if the permissions could limit write access to a single directory.

Thanks!