Docs: Clarify allowed characters in masked variables

doc/ci/variables/README.md

@@ -91,10 +91,9 @@ This means that the value of the variable will be hidden in job logs,
 though it must match certain requirements to do so:
 
 - The value must be in a single line.
-- The value must not have escape characters.
-- The value must not use variables.
-- The value must not have any whitespace.
+- The value must contain only letters, numbers, or underscores.
 - The value must be at least 8 characters long.
+- The value must not use variables.
 
 If the value does not meet the requirements above, then the CI variable will fail to save.
 In order to save, either alter the value to meet the masking requirements