Pete, those instructions you are quoting from are about locking down the CFIDE in IIS. Yet you later refer to the location of the CFIDE within the JRun instance directory, which is used for the built-in web server by default. That’s not what the lockdown guide is referring to. That said, if perhaps you have a CFIDE virtual directory defined in IIS that points to it, then the lockdown guide would apply—with respect to how you lockdown IIS’s use of that virtual directory (in which case, it doesn’t matter where the directory is that the VD points to.)
So to answer your primary question, you want to put those XML entries in either the applicationhost.config file, or in the web.config file (in the docroot of the IIS site pointing to a CFIDE directory.) I think if you re-read the doc now, with this new perspective, if should make sense.
If you are feeling lost and want to resolve things, there are people (myself included) who can provide direct remote assistance in resolving these and any other CF errors. I keep a list of such consultants at cf411.com/cfconsult. Hope that’s helpful.