userguide: ip keyword updates v1

[jmtaylor90]

Make sure these boxes are signed before submitting your Pull Request -- thank you.

• I have read the contributing guide lines at https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Contributing
• I have signed the Open Information Security Foundation contribution agreement at https://suricata.io/about/contribution-agreement/
• I have updated the user guide (in doc/userguide/) to reflect the changes made (if applicable)

Link to redmine ticket:

Describe changes:

• update example rules to match rule style in other parts of the userguide
• minor grammar updates

#suricata-verify-pr:
#suricata-verify-repo:
#suricata-verify-branch:
#suricata-update-pr:
#suricata-update-repo:
#suricata-update-branch:
#libhtp-pr:
#libhtp-repo:
#libhtp-branch:

[codecov]

Codecov Report

Merging #8140 (7d8ae0e) into master (160c778) will increase coverage by 0.00%.
The diff coverage is n/a.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #8140   +/-   ##
=======================================
  Coverage   81.67%   81.67%           
=======================================
  Files         962      962           
  Lines      276781   276781           
=======================================
+ Hits       226052   226074   +22     
+ Misses      50729    50707   -22     

Flag	Coverage Δ
fuzzcorpus	63.41% <ø> (+0.04%)	⬆️
suricata-verify	59.35% <ø> (-0.02%)	⬇️
unittests	63.35% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

[victorjulien]

Merged in #8165, thanks!