Add clarity to build.author conditionals around spoofing

[Conditionals](https://buildkite.com/docs/pipelines/conditionals) are a really great feature that we'd like to use, but there was some uncertainty as to where the build.author information comes from. Can we be sure that this data comes from GitHub metadata, and can't be spoofed per-commit?

Adding some additional information to the docs around this would help alleviate concern. Thanks!