Change wording on toServices limitations (see #20067)

PR #21052 updated Cilium documentation to say that, in network policy
rules, `toServices` statements cannot be combined with `toPorts`
statements. I believe it would be more informative for Cilium users
to say (following RFC 2119) that `toServices` _must not_ be combined
with `toPorts`, as technically Cilium accepts such a network policy
as valid but handles it in the unexpected and potentially dangerous
(e.g. if a setup relies on Cilium network policy to implement egress
filtering) manner described in #20067.

Signed-off-by: Anton Tykhyy <atykhyy@gmail.com>

Documentation/security/policy/language.rst

@@ -304,8 +304,9 @@ have ``external:yes`` set as the label.
 Limitations
 ~~~~~~~~~~~
 
-``toServices`` statements cannot be combined with ``toPorts`` statements in the
-same rule.
+``toServices`` statements must not be combined with ``toPorts`` statements in the
+same rule. In the presence of a ``toPorts`` statement, ``toServices`` does nothing
+and as a result all egress traffic to port(s) specified by ``toPorts`` is allowed.
 
 .. _Entities based: