backport 6.x: doc: update file.data keyword documentation v1 6563

[jmtaylor90]

Make sure these boxes are signed before submitting your Pull Request -- thank you.

• I have read the contributing guide lines at
  https://docs.suricata.io/en/latest/devguide/codebase/contributing/contribution-process.html
• I have signed the Open Information Security Foundation contribution agreement at
  https://suricata.io/about/contribution-agreement/ (note: this is only required once)
• I have updated the user guide (in doc/userguide/) to reflect the changes made (if applicable)

Link to redmine ticket:

https://redmine.openinfosecfoundation.org/issues/6563

Describe changes:

• backport of file.data keyword doc updates

Provide values to any of the below to override the defaults.

To use a pull request use a branch name like pr/N where N is the
pull request number.

Alternatively, SV_BRANCH may also be a link to an
OISF/suricata-verify pull-request.

SV_REPO=
SV_BRANCH=
SU_REPO=
SU_BRANCH=
LIBHTP_REPO=
LIBHTP_BRANCH=

[jufajardini]

While reviewing our merging PR, I noticed a difference between the documentation for file.data in 6 and the ones for 7 and 8. Left an inline comment about it :)

[jufajardini]

A bit confused wrt why this was left here, but removed from 7 and 8 documentation.

[jmtaylor90]

It looks like I missed this part when I was fixing up the cherry-pick conflicts (I also apparently forgot the -x). I can get this fixed up.

[jufajardini]

I see, thanks! I'll leave the decision to Victor in this, but IMHO a fixup works.

[inashivb]

Missing the cherry-picked from line in commit message needed to correlate backports. See 2440413

It can be done with git cherry-pick -x <commit-hash> while cherry picking a commit.

[victorjulien]

Missing the cherry-picked from line in commit message needed to correlate backports. See 2440413

It can be done with git cherry-pick -x <commit-hash> while cherry picking a commit.

I don't think this is critical for doc backports, esp contributed ones. And especially since we're not documenting this anywhere. See also https://redmine.openinfosecfoundation.org/issues/6568

[jmtaylor90]

continued in #9867