Context

C2C would like to switch mongosync to use driver-native APIs rather than RunCommand. (See REP-7345)

We can't do that, though, unless `addCommandFields` is supported across all request APIs. This was added for GODRIVER-3668, which only added it for update-related commands. For mongosync to use driver APIs we would need all relevant commands (e.g., FindOne, DeleteOne) to accept this parameter in internal options.

Definition of done

All relevant requests should accept & correctly handle `addCommandFields` when the relevant "xoptions.SetInternal..." function is called on all mongo.Collection and mongo.IndexView request APIs. Explicitly out of scope:

• Aggregate / Watch, which already accept arbitrary top-level fields via SetCustom.
• Database- and Client-level APIs: RunCommand, ListCollections, CreateCollection, Database.Drop.

APIs newly covered by this ticket:
DeleteOne, DeleteMany, Find, FindOne, FindOneAndDelete, Distinct, CountDocuments, EstimatedDocumentCount, Collection.Drop, IndexView.List, IndexView.CreateOne/CreateMany, IndexView.DropOne/DropAll.

Notes: Collection.Drop on an encrypted collection applies the fields only to the data-collection drop, not the ESC state-collection drops.

( Already covered by GODRIVER-3668: InsertOne, InsertMany, UpdateOne, UpdateMany, ReplaceOne, FindOneAndUpdate, FindOneAndReplace, Collection.BulkWrite, Client.BulkWrite. )

Per-API checklist:

1. A matching xoptions.SetInternal<X>Options case for "addCommandFields" exists and type-checks the value as bson.D, returning the standard type error otherwise.
2. The corresponding internal operation builder exposes AdditionalCmd(bson.D) and splices the fields as top-level elements of the command document.
3. Integrations tests are added for all updated APIs.
4. Doc comments on the new setters carry the internal-use-only disclaimer and the injection-risk warning raised in triage:
   • Dots and $-prefixed keys.
   • Duplicate keys: {"find": "coll", "find": "other"}.
   • The driver appends readConcern, writeConcern, lsid, txnNumber, $clusterTime, and $db after command() returns, so a caller-supplied key of any of those names lands before the driver's and produces a duplicate.
     Extend to a xoptions/doc.go stating that the Go driver won’t validate correctness.
   • Mark xoptions to some variant of “unsafe”.