docs: document the dry run behavior

  declare a `RENOVATE_TOKEN` variable with an access token.

* You'll also probaly need to declare a `GITHUB_COM_TOKEN` variable, holding a GitHub access token

  (for [fetching changelogs](https://docs.renovatebot.com/getting-started/running/#githubcom-token-for-changelogs))

### Dry-run implementation details

Depending on the source of a pipeline, the template will either perform your dependency updates (create/update/delete branches and MRs)

or [perform a dry run](https://docs.renovatebot.com/self-hosted-configuration/#dryrun) (to preview the behavior of Renovate with logs, without making any changes to your repositories).

The real dependency updates is triggered only when:

- the pipeline is started from the **web interface** (menu _Build > Pipelines_, click _Run pipeline_),

- or the pipeline is started from a **scheduled run** (menu _Build > Pipeline schedules_).

In any other case (regular Git commit or else) the template will perform a dry run.

:warning: Dry-run behavior is enabled/disabled with the `RENOVATE_DRY_RUN` environment variable. 

Please don't try to override it or you might break the default template implementation.