Document how we load environment variables from .env

There is a precedence of /etc/vulnerablecode/.env over the local .env
file in all cases

Reported-by: Hritik Vijay <hritikxx8@gmail.com>
Signed-off-by: Philippe Ombredanne <pombredanne@nexb.com>

Author: pombredanne

docs/source/misc.rst

@@ -36,3 +36,13 @@ Start this timer with::
     systemctl --user daemon-reload
     systemctl --user start vulnerablecode.timer
 
+
+
+Environment variables configuration
+--------------------------------------
+
+VulnerableCode loads environment variables from an `.env` file when provided.
+VulnerableCode first checks the file at `/etc/vulnerablecode/.env` and if not
+present, it will attempt to load a `.env` file from the checkout directory.
+
+The file at `/etc/vulnerablecode/.env` has precedence.