SERVER-133600 introduced a gate where acting on a restricted namespace like config.multiUpdateCoordinators, config.rangeDeletions additionally requires the same actions on the pseudo namespace admin.system.authForInternalNamespace. Enforcement is opt-in per call site: every command must remember to call
auth::addImplicitPrivilegesForRestrictedNamespaces() before checking privileges.

This ticket is to have a central place for this auth check such that commands don't need to remember to call the above function.