Monitoring data can now be stored in `metrics-*` patterns when collected through elastic-agent. [Our documentation](https://www.elastic.co/guide/en/kibana/current/monitoring-data.html) recommends to use the `monitoring_user` role to view the data in Stack Monitoring application but that role does not have permissions to read from the metrics pattern.

`monitoring_user` should be allowed the same permissions on `metrics-*` as `.monitoring-*`
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authz/RBACEngineTests.java
.addApplicationPrivilege(app1All, Collections.singleton("foo/bar/baz"))
            .addApplicationPrivilege(app2Read, Collections.singleton("foo/bar/*"))
            .addApplicationPrivilege(app2Write, Collections.singleton("*/bar/*"))
            .build();
        RBACAuthorizationInfo authzInfo = new RBACAuthorizationInfo(role, null);
        List<String> resources = new ArrayList<>();
        resources.add("foo/1");
        resources.add("foo/bar/2");
        resources.add("foo/bar/baz");
        resources.add("baz/bar/foo");
        Collections.shuffle(resources, random());
        List<String> privileges = new ArrayList<>();
        privileges.add("read");
        privileges.add("write");
        privileges.add("all");
        Collections.shuffle(privileges, random());
        final PrivilegesCheckResult response = hasPrivileges(
            new IndicesPrivileges[0],
            new ApplicationResourcePrivileges[] {
                ApplicationResourcePrivileges.builder().application("app1").resources(resources).privileges(privileges).build(),
                ApplicationResourcePrivileges.builder().application("app2").resources(resources).privileges(privileges).build() },
            authzInfo,
            privs,
            Strings.EMPTY_ARRAY
        );
        assertThat(response.allChecksSuccess(), is(false));
        assertThat(response.getDetails().index().values(), Matchers.emptyIterable());
        assertThat(response.getDetails().application().entrySet(), Matchers.iterableWithSize(2));
        final Collection<ResourcePrivileges> app1 = response.getDetails().application().get("app1");
        assertThat(app1, Matchers.iterableWithSize(4));