make-ca: Add a note about hg.mozilla.org trust chain update

Why are they using a new trust chain even when the old root CA is not
expired?

postlfs/security/make-ca.xml

@@ -79,6 +79,18 @@
       </listitem>
     </itemizedlist>
 
+    <note>
+      <para>
+        This package ships a CA certificate for validating the identity of
+        <ulink url='&certhost;'/>.  If the trust chain of this website
+        has been changed after the release of make-ca-&make-ca-version;,
+        it may fail to get the revision of <filename>certdata.txt</filename>
+        from server.  Use an updated make-ca release at
+        <ulink url='https://github.com/lfs-book/make-ca/releases'>the
+        release page</ulink> if this issue happens.
+      </para>
+    </note>
+
     <bridgehead renderas="sect3">make-ca Dependencies</bridgehead>
 
     <bridgehead renderas="sect4">Required</bridgehead>