Document lua_call feature

[TarantoolBot]

Product: Tarantool
Since: 3.2
Root document:

• https://www.tarantool.io/en/doc/latest/reference/configuration/configuration_reference/
• https://www.tarantool.io/en/doc/latest/platform/replication/supervised_failover/#configuring-a-cluster

SME: @ mandesero @ Totktonada

Details

To be done together with before #4552.

Target release: 3.2.0.

<user_or_role_name>.privileges.lua_call:

Defines the Lua functions that the specified user or a user with the
specified role has permission to call. This field accepts a special
value, all, which grants the privilege to use any global non-built-in
Lua functions.

For example, setting
credentials.users.alice.privileges.lua_call = ['foo']
allows the user alice to execute the foo function.

Requested by @mandesero in tarantool/tarantool@e7c7b24 (issue, pull request).

[Totktonada]

Taking into account #4552 it is especially important to rewrite the example of granting a privilege to call failover.execute to lua_call, because this way it is possible to switch from tarantool 2.x directly to tarantool 3.x with the failover coordinator (the non-upgraded schema doesn't prevent us from giving the privilege and so the coordinator is able to assign a leader).

The example now is the following:

credentials:
  users:
    replicator:
      password: 'topsecret'
      roles: [ replication ]
      privileges:
      - permissions: [ execute ]
        functions: [ 'failover.execute' ]

Plus a role with box.schema.func.create('failover.execute', {<...>}).

Now, the configuration is the following:

credentials:
  users:
    replicator:
      password: 'topsecret'
      roles: [ replication ]
      privileges:
      - permissions: [ execute ]
        lua_call: [ 'failover.execute' ] # !! changed

And the role is not needed.

It works on 3.2+.

Is works if all the instance are RO on 3.3+ that allows a seamless upgrade from 2.x on 3.3+.