If an aggregate with $changeStream is sent to a shard, the shard will:

• use AutoGetCollection to take a collection lock on the change stream's underlying namespace
• use AutoGetCollectionForReadCommand to take a collection lock on the oplog (since nss is reset to "oplog.rs" for change streams)

Since shard version checking is done in AutoGetCollectionForReadCommand but not AutoGetCollection, this means the changeStream on the shard does not check shardVersion for the change stream's underlying namespace, but for "oplog.rs".

This can be fixed by changing AutoGetCollection for change streams in runAggregate() to AutoGetCollectionForReadCommand, but may cause complications with currentOp and top output.

CC charlie.swanson, also would we want to backport this to 3.6?