Monitoring data can now be stored in `metrics-*` patterns when collected through elastic-agent. [Our documentation](https://www.elastic.co/guide/en/kibana/current/monitoring-data.html) recommends to use the `monitoring_user` role to view the data in Stack Monitoring application but that role does not have permissions to read from the metrics pattern.

`monitoring_user` should be allowed the same permissions on `metrics-*` as `.monitoring-*`
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authz/RBACEngineTests.java
assertFalse(RBACEngine.checkSameUserPermissions(action, request, authentication));
    }
    public void testSameUserPermissionDoesNotAllowChangePasswordForAccessToken() {
        final Authentication authentication = AuthenticationTestHelper.builder().realm().build(false).token();
        final ChangePasswordRequest request = new ChangePasswordRequestBuilder(mock(Client.class)).username(
            authentication.getEffectiveSubject().getUser().principal()
        ).request();
        final String action = ChangePasswordAction.NAME;
        assertThat(request, instanceOf(UserRequest.class));
        assertFalse(RBACEngine.checkSameUserPermissions(action, request, authentication));
    }
    public void testSameUserPermissionDoesNotAllowChangePasswordForLookedUpByOtherRealms() {
        final Authentication authentication = AuthenticationTestHelper.builder()
            .realm()
            .runAs()
            .realmRef(
                new Authentication.RealmRef(
                    randomAlphaOfLengthBetween(3, 8),
                    randomFrom(
                        LdapRealmSettings.LDAP_TYPE,
                        FileRealmSettings.TYPE,
                        LdapRealmSettings.AD_TYPE,
                        PkiRealmSettings.TYPE,
                        randomAlphaOfLengthBetween(4, 12)
                    ),
                    randomAlphaOfLengthBetween(3, 8)
                )
            )
            .build();
        final ChangePasswordRequest request = new ChangePasswordRequestBuilder(mock(Client.class)).username(