Confusing docs for IMPORT_LOCAL_PATHS

[bugreport0]

• Gitea version (or commit ref): 1.5.2

Description

The documentation and usage for IMPORT_LOCAL_PATHS is confusing from a security standpoint, since it's next to DISABLE_GIT_HOOKS in the Config Cheat Sheet.

After much reading, my interpretation is that:

• setting DISABLE_GIT_HOOKS to true is the 'safe' option
• setting IMPORT_LOCAL_PATHS to false is the 'safe' option

The documentation for both options actually begins with: 'Prevent all users from…' which might lead some users to believe that setting both options to true is the 'safe' thing.

Maybe we should change the docs to something like:

• DISABLE_GIT_HOOKS: Set to true to prevent all users from…
• IMPORT_LOCAL_PATHS: Set to false to prevent all users from…

If I misinterpreted everything, maybe we should rename the option to DISABLE_LOCAL_IMPORT?

(Footnote: I know 'safe' is relative, that's why it's in quotes. And I've read through #2501 and #3997 but I'm still unsure about what is 'safe' and what not.)