$changeStream's private showSystemEvents option re-admits system.js into a database- or cluster-scoped stream without requiring any privilege on system.js.

Since system.js stores server-side JavaScript that often embeds credentials, a role with only find+changeStream on a database or cluster could read it.

Fix: filter events for changeStream on system.js when showSystemEvents is used on a database- or cluster-scoped stream.

Built-in roles are unaffected.

Other system collections (buckets, resharding, views) aren't affected by this gap and don't need the same fix.