Add a note in the graph readme to tell that one can restrict usernames

Referencing: #6379

**Snip start:**
Agreed. But that would require adding at least some basic section which outlines the user/group management capabilities of the graph service. Just adding a note about 'GRAPH_USERNAME_MATCH' without more context won't help much.

I think that is beyond the scope of this PR, which tries to address a somewhat serious issue.

Please, open a new issue, feel free to assign it to me and I'll happily provide content about the user management settings in a separate PR.
**Snip end:**