When 2.1 is released the SRB2 Wiki will most certainly need to have some form of documentation for Lua. I'll be making sure of this at the very least if noone else will.
As for your questions, yes, Lua scripts can be used in WADs themselves. But they can also be in seperate files of their own, so in a way they're similar to SOC lumps (except they're not).
As for what Jayoshi is saying about WADs though, that's not quite true. Existing objects's properties and states etc are obviously changable by SOC, and sprites, maps, sounds and music are easily replacable too. And then there's also all the "MAINCFG category" timers etc that can be modified. So basically SOC and the like can already change how SRB2 works, just not to a very large extent.