yaml/firewall: expand firewall options explanation

suricata.yaml.in

@@ -2379,6 +2379,20 @@ firewall:
   # in order and rules are applied in that order (per state, see docs)
   #rule-files:
   #  - firewall.rules
+  #
+
+  # Default policies
+  #
+  # Choose a default policy for each firewall hook.
+  # It is also possible to specify policies by app-layer protocol.
+  # DNS example: Drop and alert on all DNS requests that are not allowed in firewall.rules, accept all responses.
+  #
+  #policies:
+  #  packet-filter: ["drop:packet"]
+  #  dns:
+  #    request-started: ["accept:hook"]
+  #    request-complete: ["drop:flow", "alert"]
+  #    response-started: ["accept:tx"]
 
 ##
 ## Include other configs