document that the WeakFilePermissions access predicate should return at most one value

ql/src/queries/security/cwe-732/WeakFilePermissions.ql

@@ -40,6 +40,8 @@ bindingset[p]
 string access(int p) {
   p.bitAnd(2) != 0 and result = "writable"
   or
+  // report only the "most permissive" permission, i.e. report the file as
+  // readable only if it is not also writable
   p.bitAnd(2) = 0 and p.bitAnd(4) != 0 and result = "readable"
 }