The test coverage of the direct connection ddl checks has so far mostly been unittesting - the purpose of this ticket is to add targeted tests which check that

1. direct ddls against replica sets are allowed without special permissions
2. direct ddls against nodes started with --shardsvr or --configsvr --replicaSetConfigShardMaintenanceMode are allowed without special permissions
3. direct ddls started after the initialization of sharding during addShard are disallowed with normal permissions but allowed with special permissions
4. direct ddls started before the initialization of sharding must be drained before addShard can continue
5. direct ddls against members of a sharded cluster are disallowed