We want non-tokenized invocations to demand an explicit privilege action, and so we also need to change the $queryStats stage to say that invocations without 'transformIdentifiers' are not allowed with only the queryStatsRead privilege.

At the time of this filing it's still being discussed whether this should be part of the clusterManager role by default like the existing action