doc/upgrade: mention that lua rules are enabled by default

Author: jasonish

doc/userguide/upgrade.rst

@@ -92,7 +92,8 @@ Major changes
   E.g., ``ipv4-csum: valid`` will only match if the check sum is valid, even when engine
   checksum validations are disabled.
 - Lua detection scripts (rules) now run in a sandboxed
-  environment. See :ref:`lua-detection`.
+  environment. See :ref:`lua-detection`. Lua rules are now also
+  enabled by default.
 - Lua output scripts have no default module search path, a search path
   will need to be set before external modules can be loaded. See the
   new default configuration file or :ref:`lua-output-yaml` for more