Follow-up to SERVER-132430.

$_internalKeyStringValue is registered with REGISTER_STABLE_EXPRESSION (src/mongo/db/pipeline/expression.cpp), which sets both AllowedWithApiStrict::kAlways and AllowedWithClientType::kAny. The kAlways half means this undocumented, _internal-prefixed expression is permitted under apiVersion: "1", apiStrict: true and is therefore nominally part of the stable API, implying a compatibility guarantee that was never intended.

Change AllowedWithApiStrict to kNeverInVersion1 so the expression is rejected when apiStrict: true is set, while remaining available to clients that do not request strict API versioning.

Why this is separate from SERVER-132430

The expression cannot be restricted by client type. mongosync calls it to translate values into collation-aware index keys (SERVER-82815, which was filed for that purpose to fix REP-3312), over an ordinary client connection, so AllowedWithClientType::kInternal would break mongosync. mongosync does not use apiStrict, so changing only the AllowedWithApiStrict half does not affect it.

SERVER-132430 bounds the memory the expression can allocate and is the change that addresses the DoS exposure; it is intended for backport. This ticket is an API-surface cleanup with no security urgency and should not be backported, which is why it is tracked separately.

Notes

• Verify no test asserts that this expression is available under apiStrict: true. jstests/aggregation/parsing/api_version_stage_allowance_checks.js and jstests/aggregation/parsing/internal_stage_user_rejection.js are the relevant places; the latter audits stages rather than expressions, so an equivalent expression-level audit may be worth adding.
• Removing an operator from the stable API surface may warrant a compatibility review even though no supported user should depend on an _internal-prefixed operator.