Tracks the server fix for the following vulnerability:

In applyOps, a command op (op:"c") has its authorization and execution target diverge:

• Auth (OplogApplicationChecks::checkOperationAuthorization) remaps nss to the ui UUID's collection but keeps only its database, then authorizes the inner command parsed from the o body — i.e. it checks rights on <UUID-db>.<o-coll>.
• Execution (drop/collMod/dropIndexes applyFuncs) resolves the target purely by UUID via extractNsFromUUIDorNs, with no o-vs-UUID consistency check (the CRUD branch has one — error 3318200; the command branch doesn't).

A 'c' op with a ui only escalates to useUUID (not superuser), so a caller with cluster {applyOps, useUUID} + drop rights on their own collection can drop/dropIndexes/collMod a victim collection (UUID read via listCollections) they have no rights on.