Elaborate on OSSEC alert instructions

Addresses #788 
Need to make edits to install.md to account for new document
This seems to imply that the `ossec_alert_email` and the sasl creds are linked. While they may be, I'm pretty sure that's not always the case (for example, in the Gmail case described in the next section). I'm not sure of the ways this can be set up, or the ways that it is commonly set up. @dolanjs thoughts?