Update event security logs documentation regarding logging charm operations (#1140)

Signed-off-by: Marcelo Henrique Neppel <[email protected]>

Author: marceloneppel

docs/.custom_wordlist.txt

@@ -77,6 +77,7 @@ nameservers
 Nextcloud
 otf
 Parca
+patroni
 Patroni
 Patroni*
 pgAudit

docs/explanation/security/index.md

@@ -104,6 +104,8 @@ The following information is configured to be logged:
 
 Other events, like connections and disconnections, are logged depending on the value of the charm configuration options related to them. For more information, check the configuration options with the `logging` prefix in the [configuration reference](https://charmhub.io/postgresql-k8s/configurations#logging_log_connections).
 
+Also, all operations performed by the charm as a result of user actions — such as enabling or disabling plugins, managing TLS, creating or restoring backups, and configuring replication between clusters (asynchronous or logical) — are executed through the underlying workload components (PostgreSQL, Patroni, or pgBackRest). Consequently, these operations are recorded in the respective workload log files, which are accessible in the `/var/log/postgresql` directory and also forwarded to COS.
+
 No secrets are logged.
 
 ## Additional Resources