Allow non-superusers to run ALTER TABLE REROUTE commands

[hlcianfagna]

Problem Statement

In CrateDB Cloud and other security-sensitive setups, database admins may not routinely have access to the crate superuser account.
The ALTER TABLE ... REROUTE MOVE SHARD commands are useful to move around "hot shards" as described in the documentation.
Currently these operations are not allowed even when a user account has AL and DDL permissions at cluster level.

Possible Solutions

• Allow the operations for accounts with certain permissions so that the task can be delegated and run without connecting as crate
• Cover REROUTE use cases in some other way so that manual rerouting is not necessary

Considered Alternatives

Get an admin with access to the CrateDB nodes to connect locally as crate and run the required commands.

[mfussenegger]

TBD which option to use:

• Let users with AL permission execute it
• Go alternative path and support GRANT role crate to ..., to grant users all superuser privileges (See Ability to grant / inherit superuser privileges to regular user #16033)
• Others?

[matriv]

Imho, users with AL should be able to execute this. The ability to inherit superuser to a role/user, would be a way to do that, but I believe explicit granting of AL should also work.

[BaurzhanSakhariev]

Imho, users with AL should be able to execute this. The ability to inherit superuser to a role/user, would be a way to do that, but I believe explicit granting of AL should also work.

Makes sense to me, as we already allow non-superusers to run ALTER CLUSTER commands (#11283)

ALTER CLUSTER is a more "global" command so it's probably logical for users to expect
that they can also run ALTER TABLE REROUTE with AL privileges.