doc: Update SAST Custom Ruleset docs with ambiguous passthrough refs

What does this MR do and why?

Document support for specifying ambiguous refs during passthrough custom configurations. Previously format required refs/heads/foo but now foo can be specified ambiguously and determined automagically.

• Discussed briefly in #393452 (comment 1387286801)
• Added in gitlab-org/security-products/analyzers/ruleset!18 (merged)
• Added to semgrep in gitlab-org/security-products/analyzers/semgrep!300 (merged)
• Pending in nodejs-scan in gitlab-org/security-products/analyzers/nodejs-scan!147 (merged)

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.