Add details on callback cycles reservation in security best practices

[andrew-lee-work]

This issue is a follow-up from the PR for journaling best practices. There is not enough detail about cycles reservation in one of our recommendations in rust-canister-development-security-best-practices.md:

#### Recommendation

Recall that the responses to inter-canister calls are processed in the corresponding callback. If the callback traps, the cleanup (ic0.call_on_cleanup) is executed. When making an inter-canister call, the ICP reserves sufficiently many cycles to execute the response callback or cleanup (up to the instruction limit). A fixed fraction of the reservation is for the cleanup. Thus, a response or cleanup execution can never “run out of cycles”, but they can run into the instruction limit and trap.

Issue raised by oggy:

Do you actually know which percentage is reserved? This sounds like something we should document, maybe here?
Can you still hit that percentage limit in the call_on_cleanup?

Originally posted by @oggy-dfin in #2356 (comment)