improve doc of substring() function including new feature

[rgerhards]

Length of substring can now also be negative as a shortcut for some common situations.

see also: https://github.com/rsyslog/rsyslog/pull/5065