Add documentation for DR reindex endpoint

[jasonodonnell]

The sys/replication/reindex endpoint doesn't work with DR so I've documented the correct endpoint.

[maxb]

I'm no longer with an employer that maintains an Enterprise subscription, so I'm unable to check this myself, but recently I flagged some inconsistencies between the list of reindex-related sudo/root-protected paths in the code (the sudo/root-protection list is in the OSS repo) and the documentation.

#20669 (comment)

At the time, it was implied that sys/replication/reindex was the only reindex endpoint. Based on this PR now calling that into question, I suspect there is an error in the sudo/root-protection path list which results in DR reindex inconsistently not requiring sudo, whilst Performance reindex does. (The specific to DR reindex API path that is in the root protection patterns is sys/replication/dr/reindex rather than sys/replication/dr/secondary/reindex per this documentation update.)

Whilst you're looking at that, the root-protection list also contains sys/replication/performance/reindex which isn't in the documentation, and was also claimed to not exist in #20669 (comment)

I did wonder if this counted as a security bug that needed confidential reporting, but I figure the sudo requirement is a fairly minor additional layer - there's still no vulnerability unless users have been given access in ACL policies to invoke the operation, so on balance I felt it was OK to respond in context here.

[jasonodonnell]

Hi @maxb!

At the time, it was implied that sys/replication/reindex was the only reindex endpoint. Based on this PR now calling that into question, I suspect there is an error in the sudo/root-protection path list which results in DR reindex inconsistently not requiring sudo, whilst Performance reindex does. (The specific to DR reindex API path that is in the root protection patterns is sys/replication/dr/reindex rather than sys/replication/dr/secondary/reindex per this documentation update.)

DR operation tokens, which is required for the DR, is treated as a special case. As far as I can tell, this is working as intended, but I'm looking into it more.

Whilst you're looking at that, the root-protection list also contains sys/replication/performance/reindex which isn't in the documentation, and was also claimed to not exist in #20669 (comment)

Thanks, I'll look into this!