bake: requires explicit allow for local output delete mode

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>

docs/bake-reference.md

@@ -901,6 +901,10 @@ target "default" {
 }
 ```
 
+> [!NOTE]
+> Local outputs with `mode=delete` require granting `--allow=local-output-delete`
+> when invoking `docker buildx bake`.
+
 ### `target.policy`
 
 Policies to validate build sources and metadata. Each entry uses the same keys

docs/reference/buildx_bake.md

@@ -85,6 +85,9 @@ The `fs` entitlements take a path value (relative or absolute) to a directory
 on the filesystem. Alternatively, you can pass a wildcard (`*`) to allow Bake
 to access the entire filesystem.
 
+Bake also supports `--allow=local-output-delete` to grant local outputs
+permission to delete stale files when `mode=delete` is set.
+
 ### Example: fs.read
 
 Given the following Bake configuration, Bake would need to access the parent