chore(aap): update doc (#14627)

Updating documentation for appsec env vars.

APPSEC-58715
APPSEC-58683

## Checklist
- [x] PR author has checked that all the criteria below are met
- The PR description includes an overview of the change
- The PR description articulates the motivation for the change
- The change includes tests OR the PR description describes a testing
strategy
- The PR description notes risks associated with the change, if any
- Newly-added code is easy to change
- The change follows the [library release note
guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html)
- The change includes or references documentation updates if necessary
- Backport labels are set (if
[applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting))

## Reviewer Checklist
- [x] Reviewer has checked that all the criteria below are met 
- Title is accurate
- All changes are related to the pull request's stated goal
- Avoids breaking
[API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces)
changes
- Testing strategy adequately addresses listed risks
- Newly-added code is easy to change
- Release note makes sense to a user of the library
- If necessary, author has acknowledged and discussed the performance
implications of this PR as reported in the benchmarks PR comment
- Backport labels are set in a manner that is consistent with the
[release branch maintenance
policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)

Author: christophe-papazian

docs/configuration.rst

@@ -461,8 +461,8 @@ Metrics
      version_added:
        v3.11.0:
 
-AppSec
-------
+Application & API Security
+--------------------------
 
 .. ddtrace-configuration-options::
 
@@ -528,6 +528,29 @@ AppSec
      default: True
      description: Whether to enable stack traces in reports for ASM. Currently used for exploit prevention reports.
 
+   DD_APPSEC_WAF_TIMEOUT:
+     type: Float
+     default: 5.0 (unit:milliseconds)
+     description: |
+       Each time the WAF is run to analyze a possible threat, this timeout duration is used to limit the WAF analysis.
+       You can increase this value if you're expecting large request payloads to be analyzed.
+       Please note that the WAF can be queried multiple times in a single trace.
+
+   DD_API_SECURITY_MAX_DOWNSTREAM_REQUEST_BODY_ANALYSIS:
+     type: Integer
+     default: 1
+     description: Maximum number of downstream requests per request whose (request and response) bodies will be analyzed by the WAF
+
+   DD_API_SECURITY_DOWNSTREAM_REQUEST_BODY_ANALYSIS_SAMPLE_RATE:
+     type: Float
+     default: 0.5 (between 0. and 1.)
+     description: sampling rate for body analysis of downstream requests. Default value is 50%.
+
+Code Security
+-------------
+
+.. ddtrace-configuration-options::
+
    DD_IAST_ENABLED:
      type: Boolean
      default: False