Add documentation for OWASP ModSecurity

[weiiwang01]

Applicable spec:

Overview

Add documentation for OWASP ModSecurity related charm configurations.

Rationale

Juju events changes

Module changes

Library changes

Checklist

• The charm style guide was applied
• The contributing guide was applied
• The changes are compliant with ISD054 - Managing Charm Complexity
• The documentation is updated (RTD)
• The PR is tagged with appropriate label (urgent, trivial, senior-review-required)
• The changelog is updated with changes that affect the users of the charm.

[erinecon]

Thanks for adding this guide! Mostly nits, but the PR preview of the how-to landing page currently contains three entries for the new how-to guide, so I won't give an approval until the headers are updated :)

[erinecon]

Suggested change

	# Enable OWASP ModSecurity with core rule set
	## Enable OWASP ModSecurity with core rule set

[erinecon]

Suggested change

	# Customize ModSecurity rules
	## Customize ModSecurity rules

[erinecon]

Suggested change

	and Nginx that is developed by OWASP. You can enable the ModSecurity
	firewall in the Nginx ingress integrator charm using the
	and NGINX that is developed by OWASP. You can enable the ModSecurity
	firewall in the NGINX ingress integrator charm using the

My understanding is that "NGINX" should be formatted in all caps

[erinecon]

Suggested change

	firewalls. You can enable OWASP ModSecurity and the core rule set by
	firewalls. Enable OWASP ModSecurity and the core rule set by

Nitpick, but I think we should drop the "You can..." framing in the subsections. I think it's fine to use "You can..." in the introduction, as a way of introducing the content in the guide as an optional task that users can do for their deployment. But now that we're in the subsections and discussing the tasks, we should be more authoritative about the user's actions.

[erinecon]

Nitpick: "For example" reads like there's some other way to set this configuration to true. I understand that the user might rename their deployed nginx-ingress-integrator, so the command could be different for their setup, but for conciseness, I think we can drop "For example".

Suggested change

	setting the `owasp-modsecurity-crs` charm configuration to `true`. For
	example:
	setting the `owasp-modsecurity-crs` charm configuration to `true`:

[erinecon]

Suggested change

	You can also enable additional rules outside the core rule set by
	setting the `owasp-modsecurity-custom-rules` charm configuration option.
	The `owasp-modsecurity-custom-rules` configuration option will be put in
	the `nginx.ingress.kubernetes.io/modsecurity-snippet` Nginx ingress
	annotation with other charm-generated configuration snippets.
	Enable additional rules outside the core rule set by
	setting the `owasp-modsecurity-custom-rules` charm configuration option.
	This configuration option will be put in
	the `nginx.ingress.kubernetes.io/modsecurity-snippet` NGINX ingress
	annotation with other charm-generated configuration snippets.

Nits around authoritative writing, NGINX capitalization, conciseness

[erinecon]

Nit: Consider placing this text into a warning admonition so that it's highlighted more, e.g.

```{warning}
This option is only effective when `owasp-modsecurity-crs` is set to
`true`.
```