Reviewing the code in the atlas-connect-cluster tool, I noticed that we'd assign a `readWriteAnyDatabase` role for users if they have disabled the metadata or read tool categories. This doesn't seem right to me as disabling `metadata` should not result in elevated permissions for the db user.