doc: update -proxy, -onion and -onlynet info in tor.md

Improve the description of what these options do with regards to
tor or network traffic.

Some of the wording is from a laanwj review in PR 19358.

Author: Saibato

doc/tor.md

@@ -23,10 +23,15 @@ outgoing connections, but more is possible.
 
 	-proxy=ip:port  Set the proxy server. If SOCKS5 is selected (default), this proxy
 	                server will be used to try to reach .onion addresses as well.
+	                You need to use -noonion or -onion=0 to explicitly disable
+	                outbound access to onion services.
 
 	-onion=ip:port  Set the proxy server to use for Tor onion services. You do not
-	                need to set this if it's the same as -proxy. You can use -noonion
+	                need to set this if it's the same as -proxy. You can use -onion=0
 	                to explicitly disable access to onion services.
+	                Note: Only the -proxy option sets the proxy for DNS requests;
+	                with -onion they will not route over Tor, so use -proxy if you
+	                have privacy concerns.
 
 	-listen         When using -proxy, listening is disabled by default. If you want
 	                to run an onion service (see next section), you'll need to enable
@@ -40,7 +45,11 @@ outgoing connections, but more is possible.
 	-onlynet=onion  Make outgoing connections only to .onion addresses. Incoming
 	                connections are not affected by this option. This option can be
 	                specified multiple times to allow multiple network types, e.g.
-	                ipv4, ipv6, or onion.
+	                ipv4, ipv6 or onion. If you use this option with values other
+	                than onion you *cannot* disable onion connections; outgoing onion
+	                connections will be enabled when you use -proxy or -onion. Use
+	                -noonion or -onion=0 if you want to be sure there are no outbound
+	                onion connections over the default proxy or your defined -proxy.
 
 In a typical situation, this suffices to run behind a Tor proxy: