Document how disruptive rules work when there is an allow and deny

## Summary

Coraza will use the first disruptive action based on syntactic order only.

This needs to be documented properly.

### Basic example

Include a basic example or links here.

### Motivation

Why are we doing this? What use cases does it support? What is the expected outcome?
