update frang documentation

[RomanBelozerov]

Motivation

Please, add more information to frang documentation on working with ip_block and block_action directives.
Also, for the block_action directive I don't understand what event will call 'frang' with ip_block on\off. I think, it's "attack", but it's not written.

For example:
what should client receive on 3rd connection?

1. ip_block off; connection_burst 2; block_action attack reply; - 403 or not?
2. ip_block off; connection_burst 2; block_action attack drop; - none?
3. ip_block on; connection_burst 2; block_action attack drop; - none?
4. ip_block on; connection_burst 2; block_action attack reply; - three 403 responses?

Documentation

https://github.com/tempesta-tech/tempesta/wiki/HTTP-security

[krizhanovsky]

TODO from #1649 :

1. document that Frang remembers bursts only for 1.5 seconds
2. connection-level limits can not be used with block_action attack reply
3. discuss reasonable limits (e.g. burst of 6 connections/s and concurrent connections)
4. RST in case of 2 pipelined malicious requests and ip_block off; http_ct_vals text/*; block_action attack reply; config. It does make sense to reset a malicious connection and do not spend resources on it
5. Basically ip_block on; block_action attack reply; is a misconfiguration: Frang limits immediately call the filter blocking on IP layer and the HTTP layer will just put an HTTP response to the socket send buffer, which hung forever.

A new issue #1751 is created to avoid (5) and reset connections on the filter.c layer.

[krizhanovsky]

@RomanBelozerov I updated the page https://github.com/tempesta-tech/tempesta/wiki/HTTP-security - please review whether it is clear and answers all the questions.

Answers to the 4 questions above according to the new doc and #1751:

1. ip_block off; connection_burst 2; block_action attack reply; - 403 or not?

Connection is just reset (RST), so no any responses - there is nowhere to send the response

2. ip_block off; connection_burst 2; block_action attack drop; - none?

The same, just reset connection

3. ip_block on; connection_burst 2; block_action attack drop; - none?

Connection reset and the IP is blocked.

4. ip_block on; connection_burst 2; block_action attack reply; - three 403 responses?

Connection reset and the IP is blocked. Nothing is sent to the client