docs/framework/filesystem.md - Update [civicrm.files] subdirs

Specifically:

 * Alphabetize
 * Add general description

docs/framework/filesystem.md

@@ -161,14 +161,14 @@ The `[civicrm.files]` is a base which contains several sub-directories.
 These folders include:
 
 
-| Code Name            | Typical Path                         | Recommended Access Level                        | Data Access Patterns
+| Code Name            | Typical Path                         | Recommended Access Level                        | Comments
 | -------------------- | ------------------------------------ | ----------------------------------------------- |-----------------------------------------------------------------
-| `configAndLogDir`    | `[civicrm.files]/ConfigAndLog`       | Prohibit all web access                         | Writes and reads should be infrequent, unless there are errors/warnings.
-| `imageUploadDir`     | `[civicrm.files]/persist/contribute` | Allow file reads but prohibit directory listing | Writes and reads vary widely (depending on use-case/config).
-| `templateCompileDir` | `[civicrm.files]/templates_c`        | Prohibit all web access                         | Writes should be infrequent. Reads are very frequent.
-| `uploadDir`          | `[civicrm.files]/upload`             | Prohibit all web access                         | Writes and reads vary widely (depending on use-case/config).
-| `customFileUploadDir` | `[civicrm.files]/custom`            | Prohibit all web access                         | Writes and reads vary widely (depending on use-case/config).
-| `extensionsDir`      | `[civicrm.files]/ext`                | Allow file reads but prohibit directory listing | Writes should be infrequent. Reads are very frequent.
+| `configAndLogDir`    | `[civicrm.files]/ConfigAndLog`       | Prohibit all web access                         | Stores log files. Writes and reads should be infrequent, unless there are errors/warnings.
+| `customFileUploadDir` | `[civicrm.files]/custom`            | Prohibit all web access                         | Stores sensitive uploads (such as custom-field attachments). Writes and reads vary widely (depending on use-case/config).
+| `extensionsDir`      | `[civicrm.files]/ext`                | Allow file reads but prohibit directory listing | Stores downloaded extensions. Writes should be infrequent. Reads are very frequent. In hardened systems, this may be readonly or disabled.
+| `imageUploadDir`     | `[civicrm.files]/persist/contribute` | Allow file reads but prohibit directory listing | Stores uploaded or autogenerated media (images/css/etc). Writes and reads vary widely (depending on use-case/config).
+| `templateCompileDir` | `[civicrm.files]/templates_c`        | Prohibit all web access                         | Stores autogenerated PHP files. Writes should be infrequent. Reads are very frequent.
+| `uploadDir`          | `[civicrm.files]/upload`             | Prohibit all web access                         | Temporary files. Writes and reads vary widely (depending on use-case/config).
 
 !!! tip "Advanced filesystem and web server configurations"