Now that we have a mechanism to block and to drain ongoing replica set DDL operations, we need to plug this into add shard. This should be done before we get the list of databases to clone so that we know no databases can be lost. It also should be done after the write of the shard identity since blocking DDLs relies on this.

As part of this ticket, we should check that:

1. direct ddls started after the initialization of sharding during addShard are disallowed with normal permissions but allowed with special permissions
2. direct ddls started before the initialization of sharding must be drained before addShard can continue
3. direct ddls against members of a sharded cluster are disallowed