added descriptions of CLI args for configuring Execution Engine options (#967)

* added descriptions of CLI args for configuring Execution Engine options

Signed-off-by: Justin Florentine <justin+github@florentine.us>

* edits

Signed-off-by: Alexandra Tran <alexandra.tran@consensys.net>

Co-authored-by: Alexandra Tran <alexandra.tran@consensys.net>
Co-authored-by: Sally MacFarlane <sally.macfarlane@consensys.net>
Co-authored-by: rolandtyler <88206508+rolandtyler@users.noreply.github.com>

docs/Reference/CLI/CLI-Syntax.md

@@ -455,6 +455,151 @@ The default is `true`.
     You can override the default DNS server if it's unreliable or doesn't serve TCP DNS requests, using the
     [experimental option](#xhelp) `--Xp2p-dns-discovery-server=<HOST>`.
 
+### `engine-rpc-http-port`
+
+=== "Syntax"
+
+    ```bash
+    --engine-rpc-http-port=<PORT>
+    ```
+
+=== "Example"
+
+    ```bash
+    --engine-rpc-http-port=8550
+    ```
+
+=== "Environment variable"
+
+    ```bash
+    BESU_ENGINE_RPC_HTTP_PORT=8550
+    ```
+
+=== "Configuration file"
+
+    ```bash
+    engine-rpc-http-port=8550
+    ```
+
+The listening port for the Engine API calls (`ENGINE`, `ETH`) for JSON-RPC over HTTP.
+
+### `engine-rpc-ws-port`
+
+=== "Syntax"
+
+    ```bash
+    --engine-rpc-ws-port=<PORT>
+    ```
+
+=== "Example"
+
+    ```bash
+    --engine-rpc-ws-port=8551
+    ```
+
+=== "Environment variable"
+
+    ```bash
+    BESU_ENGINE_RPC_WS_PORT=8551
+    ```
+
+=== "Configuration file"
+
+    ```bash
+    engine-rpc-ws-port=8551
+    ```
+
+The listening port for the Engine API calls (`ENGINE`, `ETH`) for JSON-RPC over WebSockets.
+
+### `engine-host-allowlist`
+
+=== "Syntax"
+
+    ```bash
+    --engine-host-allowlist=<hostname>[,<hostname>...]... or "*"
+    ```
+
+=== "Example"
+
+    ```bash
+    --engine-host-allowlist=localhost,127.0.0.1
+    ```
+
+=== "Environment variable"
+
+    ```bash
+    BESU_ENGINE_HOST_ALLOWLIST=localhost,127.0.0.1
+    ```
+
+=== "Configuration file"
+
+    ```bash
+    engine-host-allowlist=localhost,127.0.0.1
+    ```
+
+A comma-separated list of hostnames to allow for Engine API access (applies to both HTTP and WebSockets).
+
+!!!tip
+
+    To allow all hostnames, use `"*"`. We don't recommend allowing all hostnames in production
+    environments.
+
+### `engine-jwt-enabled`
+
+=== "Syntax"
+
+    ```bash
+    --engine-jwt-enabled
+    ```
+
+=== "Example"
+
+    ```bash
+    --engine-jwt-enabled=true
+    ```
+
+=== "Environment variable"
+
+    ```bash
+    BESU_ENGINE_JWT_ENABLED=true
+    ```
+
+=== "Configuration file"
+
+    ```bash
+    engine-jwt-enabled=true
+    ```
+Enables or disables authentication for Engine APIs. The default is `false`.
+
+### `engine-jwt-secret`
+
+=== "Syntax"
+
+    ```bash
+    --engine-jwt-secret=<FILE>
+    ```
+
+=== "Example"
+
+    ```bash
+    --engine-jwt-secret=jwt.hex
+    ```
+
+=== "Environment variable"
+
+    ```bash
+    BESU_ENGINE_JWT_SECRET="publicKey.pem"
+    ```
+
+=== "Configuration file"
+
+    ```bash
+    engine-jwt-secret="jwt.hex"
+    ```
+
+The shared secret used for JSON-RPC (both HTTP and WebSocket) authentication of Engine API clients.
+Contents of file must be at least 32 hex-encoded bytes and not begin with `0x`. May be a relative or absolute path.
+
 ### `ethstats`
 
 === "Syntax"