misc/vault-keyring-client.sh: explain flock usage

Fixes: 511b6ca4 ("misc/vault-keyring-client.sh: add flock workaround")

misc/vault-keyring-client.sh

@@ -2,7 +2,7 @@
 
 readonly vault_password_file_encrypted="$(dirname $0)/vault-$2-password.gpg"
 
-# often getting "gpg: decryption failed: No secret key" in tf-stage2
-# seems to work with flock (issue last reproduced with gnupg 2.2.35)
+# flock used to work around "gpg: decryption failed: No secret key" in tf-stage2
+# would otherwise need 'auto-expand-secmem' (https://dev.gnupg.org/T3530#106174)
 flock "$vault_password_file_encrypted" \
   gpg --batch --decrypt --quiet "$vault_password_file_encrypted"