Document need for Access Database capability

In order for pull-replication to replicate `All-Users` refs, the `Access
Database` capability needs to be enabled for the user performing
replication.

The lack of such capability would prevent All-Users' meta refs from
being replicated.

Document this requirement to make Gerrit admins able to configure
pull-replication correctly.

Bug: Issue 16594
Change-Id: Id5c8ed4cf35b21e725c52d8dee397f12ab3afad1

src/main/resources/Documentation/config.md

diff --git a/src/main/resources/Documentation/config.md b/src/main/resources/Documentation/config.md
index 51b10d8..eb15c02 100644
--- a/src/main/resources/Documentation/config.md
+++ b/src/main/resources/Documentation/config.md
@@ -558,6 +558,14 @@
 remote.NAME.password
 :	Password to use for HTTP authentication on this remote.
 
+In both cases, the Global Capability `Access Database` [1] needs to be allowed
+in order to permit all `All-Users`' refs to be replicated. When _basic auth_ is
+used, the capability must be assigned to the `remote.NAME.username` used in
+configuration, whilst for _bearer token_, it needs to be assigned to
+the `Pull-replication Internal User` user.
+
+[1] https://gerrit-review.googlesource.com/Documentation/access-control.html#capability_accessDatabase
+
 File `~/.ssh/config`
 --------------------