doc: 6781 concat normalization v2

[jmtaylor90]

Make sure these boxes are signed before submitting your Pull Request -- thank you.

• [x] I have read the contributing guide lines at https://docs.suricata.io/en/latest/devguide/contributing/contribution-process.html
• [x] I have signed the Open Information Security Foundation contribution agreement at https://suricata.io/about/contribution-agreement/ (note: this is only required once)
• [x] I have updated the user guide (in doc/userguide/) to reflect the changes made (if applicable)

Link to redmine ticket: https://redmine.openinfosecfoundation.org/issues/6781

Describe changes:

• updated to address comments from #10930
• rtd build of this branch - https://rtd-test-suricata.readthedocs.io/en/latest/rules/http-keywords.html

Provide values to any of the below to override the defaults.

To use a pull request use a branch name like pr/N where N is the pull request number.

Alternatively, SV_BRANCH may also be a link to an OISF/suricata-verify pull-request.

SV_REPO=
SV_BRANCH=
SU_REPO=
SU_BRANCH=
LIBHTP_REPO=
LIBHTP_BRANCH=

[codecov[bot]]

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 82.80%. Comparing base (3a27cfd) to head (2f240a0). Report is 11 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #10937      +/-   ##
==========================================
+ Coverage   82.74%   82.80%   +0.06%     
==========================================
  Files         922      922              
  Lines      247861   248216     +355     
==========================================
+ Hits       205081   205534     +453     
+ Misses      42780    42682      -98     

Flag	Coverage Δ
fuzzcorpus	64.15% <ø> (+0.16%)	:arrow_up:
suricata-verify	62.42% <ø> (+<0.01%)	:arrow_up:
unittests	62.25% <ø> (+0.03%)	:arrow_up:

Flags with carried forward coverage won't be shown. Click here to find out more.

[victorjulien]

Merged in #11027, thanks!