docs: add integrity warning to Chocolatey iex install example

[xiaolai]

Automated audit: This PR was generated by NLPM, a natural language programming linter, running via claude-code-action. Please evaluate the diff on its merits.

Issue

packer/builders/skills/windows-builder/SKILL.md (line 106) shows a Chocolatey install using the iex + DownloadString pattern:

iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))

This is the PowerShell equivalent of curl | sh — it fetches and executes a remote script entirely in memory, with no integrity check (no checksum, no signature verification). When this pattern appears in a documentation example without a caveat, it can lead users to adopt it in production image builds without understanding the risk.

Fix

Add a comment block before the provisioner explaining the risk and pointing to the Chocolatey docs for more secure alternatives (signed installer, checksum verification). The example code itself is unchanged — only a warning comment is added.

Why it matters

Packer templates are often used to build golden AMIs or base images for production workloads. Users following this example in a CI/CD pipeline would silently accept whatever community.chocolatey.org serves at build time, with no audit trail. A brief note helps users make an informed choice without removing a useful example.

No functional code was changed in this PR.

[hashicorp-cla-app]

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

_{Have you signed the CLA already but the status is still pending? Recheck it.}