Document Input Framework and zeek -r testing tricks

[awelzel]

In reaction to: https://community.zeek.org/t/how-to-enrich-conn-logs-through-a-csv-file/7222/2

This is pretty tricky to be aware of unless you ran into it a few times. Unless we already have something in the docs (didn't find anything) appears valuable to document the continue/suspend pattern.