Clarify that cloning a runner could be considered an attack vector

Merged Lee Matos requested to merge patch-2 into master

This generated from a customer having confusion about two runners having the same token and the security implications here. I've clarified in this MR. <3