Add validation that _clusterWriteWithoutShardKey commands that have $_originalQuery and $_originalCollation set are coming from internal clients
The validation should happen here, here and here. It should do something like this.