DOCS-11101: add killAnyCursor privilege, clarify coAuthz behaviour

Author: schmalliso

source/reference/built-in-roles.txt

@@ -424,7 +424,7 @@ functions.
    - :authaction:`flushRouterConfig`
    - :authaction:`fsync`
    - :authaction:`invalidateUserCache`
-
+   - :authaction:`killAnyCursor` (New in version 3.6.3)
    - :authaction:`killAnySession` (New in version 3.6)
 
    - :authaction:`killop`

source/reference/command/killCursors.txt

@@ -41,6 +41,21 @@ Definition
 
    .. include:: /includes/apiargs/dbcommand-killCursors-field.rst
 
+Required Access
+---------------
+
+.. versionchanged:: 3.6.3
+
+To successfully execute a :dbcommand:`killCursors` command, all cursors
+that you wish to kill must be associated with a currently authenticated
+user. MongoDB associates cursors with the users that were authenticated when
+the cursor was created. If the operation is not successful due to
+permission issues, the command returns an error message.
+
+Alternatively, if a user possesses the :authaction:`killAnyCursor`
+privilege, that user may kill any cursor regardless of what users the
+cursor is associated with.
+
 Example
 -------
 

source/reference/privilege-actions.txt

@@ -47,7 +47,8 @@ Query and Write Actions
    - :dbcommand:`getMore`
    - :dbcommand:`getPrevError`
    - :dbcommand:`group`
-   - :dbcommand:`killCursors`
+   - :dbcommand:`killCursors`, provided that the cursor is associated
+     with a currently authenticated user.
    - :dbcommand:`listCollections`
    - :dbcommand:`listIndexes`
    - :dbcommand:`mapReduce` with the ``{out: inline}`` option.
@@ -254,7 +255,16 @@ Database Management Actions
 
 .. authaction:: killCursors
 
-   User can kill cursors on the target collection.
+   User can kill cursors with which they are associated. Cursors are
+   associated with the users that were authenticated when the cursor was
+   created. Apply this action to collection resources.
+
+.. authaction:: killAnyCursor
+
+   .. versionadded:: 3.6.3
+
+   User can kill **any** cursor regardless of their association
+   with the cursor. Apply this action to collection resources.
 
 .. authaction:: revokeRole