testsuite: correct the ki62 comment about MSG_IO_ERROR coverage

The header claimed protocol-level crafting of MSG_IO_ERROR is covered by
msg-io-* crafted-server tests; no such test exists (msg-io-timeout-zero
crafts MSG_IO_TIMEOUT).  Say what the test actually locks down.

rsync.h

@@ -194,8 +194,9 @@
 
 /* Mask of all currently defined IOERR_* bits.  Used to sanitize values
  * received from a peer via MSG_IO_ERROR so a malicious peer cannot set
- * arbitrary (undefined) bits in the local io_error, which would then
- * propagate to exit codes and be re-forwarded. */
+ * arbitrary (undefined) bits in the local io_error, which would then be
+ * stored and re-forwarded upstream.  (Undefined bits never reach the exit
+ * code: cleanup.c maps only these defined bits onto RERR_* values.) */
 #define IOERR_VALID_MASK (IOERR_GENERAL | IOERR_VANISHED | IOERR_DEL_LIMIT)
 
 #define MAX_ARGS 1000