filters: improve docs & protections around callbacks

We recently ran into an internal problem where an in-house filter was returning a local reply and immediately after returning `FilterHeaderStatus::Continue`, which ends up confusing the Router filter machinery.

A few things can be done to improve the experience for filter developers:

1) improve docs around the contract with filters (e.g.: #13678, I'll send another one for docs/root/faq/extensions/contract.rst as well)

2) enforce more checks to ensure callbacks cannot be called after a local reply has been sent

3) more assertions around the filter chain state machine

cc: @alyssawilk @mattklein123