filters: improve docs & protections around callbacks

We recently ran into an internal problem where an in-house filter was returning a local reply and immediately after returning FilterHeaderStatus::Continue, which ends up confusing the Router filter machinery.

A few things can be done to improve the experience for filter developers:

1. improve docs around the contract with filters (e.g.: #13678, I'll send another one for docs/root/faq/extensions/contract.rst as well)

2. enforce more checks to ensure callbacks cannot be called after a local reply has been sent

3. more assertions around the filter chain state machine

cc: @alyssawilk @mattklein123