Suricata

We mention negated content and matches in a few places (for instance, in the "Differences from Snort" chapter), but no specific section for others to refer to if searching about it.

We should have one, and cross-reference with the absent keyword docs.