Provide high level docs on how allow/disallow config works

[consideRatio]

This is the gist of it how allow/disallow config works is that each user needs to:

1. Successfully authenticate

   This is the phase where a username is determined, and misc properties of the user such as admin status.

   Failure to authenticate can stem from GoogleOAuthenticator.hosted_domain or CILogonOAuthenticator.allowed_idps config that influences the ability to determine the username.

2. Not be blocked/disallowed

   Only Authenticator.blocked_users is disallowing config

3. Be allowed

   Examples of such allowing config is: Authenticator.allow_users, Authenticator.admin_users, OAuthenticator.allow_all, OAuthenticator.allow_existing_users, GitHubOAuthenticator.allowed_organizations, ...)

[minrk]

Took a stab at this in #729