An organization's private repositories have Secret Protection and push protection enabled. The organization owner wants the rejection message to direct developers to the team's credential-handling guidance. Where should the owner configure the URL for this message?