Document the repository signing v4.9.0 service index resource (NuGet#1204)

Part of https://github.com/NuGet/Engineering/issues/1778

Author: loic-sharma

docs/api/repository-signatures-resource.md

@@ -19,16 +19,14 @@ whether a repository signed package has been tampered or has an unexpected signi
 The resource used for fetching this repository signature information is the `RepositorySignatures` resource found in
 the [service index](service-index.md).
 
-> [!Note]
-> NuGet.org will start announcing the `RepositorySignatures` resource in the near future.
-
 ## Versioning
 
 The following `@type` value is used:
 
 @type value                | Notes
 -------------------------- | -----
 RepositorySignatures/4.7.0 | The initial release
+RepositorySignatures/4.9.0 | Allows enabling `allRepositorySigned`
 
 ## Base URL
 
@@ -63,15 +61,19 @@ The following request fetches the repository signatures index.
 
 The repository signature index is a JSON document that contains an object with the following properties:
 
-Name                | Type             | Required
-------------------- | ---------------- | --------
-allRepositorySigned | boolean          | yes
-signingCertificates | array of objects | yes
+Name                | Type             | Required | Notes
+------------------- | ---------------- | -------- | -----
+allRepositorySigned | boolean          | yes      | Must be `false` on 4.7.0 resource
+signingCertificates | array of objects | yes      | 
 
 The `allRepositorySigned` boolean is set to false if the package source has some packages that have no repository
 signature. If the boolean is set to true, all packages available on the source must have a repository
 signature produced by one of the signing certificates mentioned in `signingCertificates`.
 
+> [!Warning]
+> The `allRepositorySigned` boolean must be false on the 4.7.0 resource. NuGet v4.7 and v4.8 clients cannot install packages
+> from sources that have `allRepositorySigned` set to true.
+
 There should be one or more signing certificates in the `signingCertificates` array if the `allRepositorySigned` boolean
 is set to true. If the array is empty and `allRepositorySigned` is set to true, all packages from the source should be
 considered invalid, although a client policy may still allow consumption of packages. Each element in this array is a