This needs to be tested, ideally, under the jstests/auth directory.

The logic is:

• When the aggregate stage is run against the 'admin' database, the user will need to have the new privilege called `listClusterCatalog`, which is included in the clusterMonitor built-in role.
• When the aggregate stage runs against a database other than 'admin', the user will need to own the `listCollections` action privilege for that database, which is included in the read built-in role.