Clarify in JSP documentation where method attribute is required

[jzheaux]

See #16529 for background.

We should update the reference to indicate that if the target RequestMatcher requires an HTTP method, then this method should be indicated in related <jsp:authorize> tags.